TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)

OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.

Regarding to the TLSv1.2 RFC, this version of TLS provides a "signature_algorithms" extension for the client_hello.

Data Structures

If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address.

Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash.

This mean a Segmentation Fault in tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.

StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax, byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.

radare2 static decompiled

The patch fix the vulnerability zeroing the sigalgslen.
Get David A. Ramos' proof of concept exploit here

Related word

Send Money and a Smile with Hallmark + Venmo

The loved combination of a Hallmark card and digital money, now all in one. View on the Web We found new products from one of our partners that we think is perfect for Real Simple readers — check it out! Thoughtful Hallmark Card AND Venmo Money The only thing better than a Hallmark card is a Hallmark card with money in it. But let's face it, we don't always have cash on us these days. That's why Hallmark + Venmo have teamed up to create an innovative and secure way to send the perfect gift every time. Shop Now How it Works The legacy and love of the Hallmark brand paired with the technical savvy of Venmo offers a first-of-its kind partnership from which everyone can benefit. Just scan the QR code in the card, choose the amount you want to give and handwrite a message. It's that easy! Shop Now ...

Dinero facil en internet

Buscar este blog