===================================================================== CERT-Renater Note d'Information No. 2010/VULN175 _____________________________________________________________________ DATE : 26/05/2010 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : AIX versions up to and including 5.3, 6.1 running OpenSSL. ====================================================================== http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc ______________________________________________________________________ IBM SECURITY ADVISORY First Issued: Fri May 21 10:09:57 CDT 2010 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc or ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory.asc VULNERABILITY SUMMARY VULNERABILITY: "Record of death" vulnerability PLATFORMS: AIX 5.3, 6.1, and earlier releases SOLUTION: Apply the fix as described below. THREAT: See below CVE Numbers: CVE-2009-3245 CVE-2010-0433 CVE-2010-0740 DETAILED INFORMATION I. DESCRIPTION (from cve.mitre.org) "In TLS connections, certain incorrectly formatted records can cause an OpenSSL client or server to crash due to a read attempt at NULL." "OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/ e_ubsec.c, which has unspecified impact and context-dependent attack vectors." "The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, does not check a certain return value, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via SSL cipher negotiation, as demonstrated by a chroot installation of Dovecot or stunnel without Kerberos configuration files inside the chroot." "The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number." Please see the following for more information: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3245 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0433 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0740 http://cvs.openssl.org/chngview?cn=19307 http://cvs.openssl.org/chngview?cn=19374 http://www.openssl.org/news/secadv_20100324.txt II. PLATFORM VULNERABILITY ASSESSMENT To determine if your system is vulnerable, execute the following command: lslpp -L openssl.base The following fileset levels are vulnerable: AIX 6.1 and 5.3: all versions less than or equal 0.9.8.1103 AIX 6.1 and 5.3: FIPS capable versions less than or equal 12.9.8.1103 AIX 5.2: all versions less than or equal 0.9.8.806 IMPORTANT: If AIX OpenSSH is in use, it must be updated to version 5.0 or later when updating OpenSSL. AIX OpenSSH can be downloaded from: http://sourceforge.net/projects/openssh-aix III. FIXES A fix is available, and it can be downloaded from: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp To extract the fixes from the tar file: zcat openssl.0.9.8.1103.tar.Z | tar xvf - or zcat openssl-fips.12.9.8.1103.tar.Z | tar xvf - or zcat openssl.0.9.8.806.tar.Z | tar xvf - IMPORTANT: If possible, it is recommended that a mksysb backup of the system be created. Verify it is both bootable and readable before proceeding. To preview the fix installation: installp -apYd . openssl To install the fix package: installp -aXYd . openssl IV. WORKAROUNDS There are no workarounds. V. CONTACT INFORMATION If you would like to receive AIX Security Advisories via email, please visit: http://www.ibm.com/systems/support and click on the "My notifications" link. To view previously issued advisories, please visit: http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd Comments regarding the content of this announcement can be directed to: security-alert@austin.ibm.com To obtain the PGP public key that can be used to communicate securely with the AIX Security Team you can either: A. Send an email with "get key" in the subject line to: security-alert@austin.ibm.com B. Download the key from our web page: http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgpkey.txt C. Download the key from a PGP Public Key Server. The key ID is: 0x28BFAA12 Please contact your local IBM AIX support center for any assistance. eServer is a trademark of International Business Machines Corporation. IBM, AIX and pSeries are registered trademarks of International Business Machines Corporation. All other trademarks are property of their respective holders. ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================