1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
|
Candidate: CVE-2011-5095
PublicDate: 2012-06-20
References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5095
https://discussions.nessus.org/thread/3381
http://www.nessus.org/plugins/index.php?view=single&id=53360
http://www.cl.cam.ac.uk/~rja14/Papers/psandqs.pdf
Description:
The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS
mode is enabled, does not properly validate a public parameter, which makes
it easier for man-in-the-middle attackers to obtain the shared secret key
by modifying network traffic, a related issue to CVE-2011-1923.
Ubuntu-Description:
Notes:
jdstrand> RedHat fixed this with the openssl-fips-0.9.8e-dh-check.patch
patch in 0.9.8e-20.el5 by adding the DH_check_pub_key() check to
fips/dh/fips_dh_key.c:compute_key()
jdstrand> code not present in 1.0 series and the existing dh_key.c code
already uses DH_check_pub_key() (as does the dh_key.c code in 0.9.8, but this
is not used when compiled in fips mode). For details of 1.0's FIPS status,
see http://www.openssl.org/docs/fips/fipsvalidation.html for details
jdstrand> upstream has not included RedHat's patch in their 0.9.8 series
jdstrand> fips_dh_key.c not compiled in Ubuntu
Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=834062
https://bugzilla.redhat.com/show_bug.cgi?id=698175
Priority: negligible
Discovered-by:
Assigned-to:
Patches_openssl:
vendor: http://rhn.redhat.com/errata/RHBA-2011-1010.html
upstream_openssl: ignored (code not compiled)
hardy_openssl: ignored (code not compiled)
lucid_openssl: ignored (code not compiled)
natty_openssl: ignored (code not compiled)
oneiric_openssl: not-affected (1.0.0e-2ubuntu4.6)
precise_openssl: not-affected
devel_openssl: not-affected
Patches_openssl098:
upstream_openssl098: needs-triage
hardy_openssl098: DNE
lucid_openssl098: DNE
natty_openssl098: DNE
oneiric_openssl098: ignored (code not compiled)
precise_openssl098: ignored (code not compiled)
devel_openssl098: ignored (code not compiled)
|