-----BEGIN PGP SIGNED MESSAGE-----

                 NetBSD Security Advisory 2002-009
                 =================================
                 (updated 2002/9/22)

Topic: Multiple vulnerabilities in OpenSSL code

Version: NetBSD-current: source prior to August 10, 2002
                NetBSD-1.6 beta: affected
                NetBSD-1.5.3: affected
                NetBSD-1.5.2: affected
                NetBSD-1.5.1: affected
                NetBSD-1.5: affected
                NetBSD-1.4.*: not applicable
                pkgsrc: prior to openssl-0.9.6f

Severity: Potential for remote root exploit

Fixed: NetBSD-current: August 10, 2002
                NetBSD-1.6 branch: August 11, 2002 (1.6 includes the fix)
                NetBSD-1.5 branch: August 31, 2002
                pkgsrc: openssl-0.9.6f (or later)

        NOTE: previous advisory had fixed dates prior to August 10.
        There were errors found in the vendor-supplied fix, therefore
        the fixed dates were modified. Sorry for the confusion and
        thanks for the patience.

        NOTE: previous revision of advisory suggested that 1.5 branch
        was fixed on August 1, however the fix was found to be
        insufficient. Therefore, users of 1.5 should apply the fix
        presented in this revised advisory. Sorry for the confusion
        and thanks for the patience.

        NOTE: previous revision of advisory suggested that 1.5 branch
        can be fixed by rebuilding part of the source code tree (shared
        library). However, it was incorrect. Follow the instruction below
        and perform a full build. Sorry for the confusion and thanks for
        the patience.

Abstract
========

There are multiple vulnerabilities found in openssl 0.9.6e and prior
releases. There are four remotely-exploitable buffer overruns in SSL2/3
code. The ASN1 parser can be confused by invalid encodings (SSL/TLS
code affected).

None of these services are enabled by default in NetBSD, however, by
enabling services built with these libraries, a system would become
vulnerable.

- From the OpenSSL advisory:

  "Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or
  current development snapshots of 0.9.7 to provide SSL or TLS is
  vulnerable, whether client or server. 0.9.6d servers on 32-bit systems
  with SSL 2.0 disabled are not vulnerable."

After the above advisory was published,
  - 0.9.6e was found to be vulnerable, and 0.9.6f was released.
  - 0.9.6f had some build framework errors, and 0.9.6g was released.

The NetBSD fix includes OpenSSL 0.9.6g.

Technical Details
=================

http://www.openssl.org/news/secadv_20020730.txt
http://CERT.Uni-Stuttgart.DE/advisories/c-integer-overflow.php

Solutions and Workarounds
=========================

The recent NetBSD 1.6 release is not vulnerable to this issue. A full
upgrade to NetBSD 1.6 is the recommended resolution for all users able
to do so. Many security-related improvements have been made, and
indeed this release has been delayed several times in order to include
fixes for a number of recent issues.

The following instructions describe how to upgrade your libcrypto/libssl
binaries by updating your source tree and rebuilding and
installing a new version of libcrypto/libssl.

Be sure to restart running instances of programs that use crypto libraries
(like sshd) after upgrading shared libraries.

If you have any statically-linked binaries that linked against a
vulnerable libcrypto and/or libssl, you need to recompile them.

* NetBSD-current:

        Systems running NetBSD-current dated from before 2002-08-10
        should be upgraded to NetBSD-current dated 2002-08-10 or later.

        The following directories need to be updated from the
        netbsd-current CVS branch (aka HEAD):
                crypto/Makefile.openssl
                crypto/dist/openssl
                lib/libcrypto
                lib/libssl

        To update from CVS, re-build, and re-install libcrypto and libssl:
                # cd src
                # cvs update -d -P crypto/Makefile.openssl crypto/dist/openssl \
                        lib/libcrypto lib/libssl

                # make includes
                # cd lib/libcrypto
                # make cleandir dependall
                # make install
                # cd ../../lib/libssl
                # make cleandir dependall
                # make install

* NetBSD 1.6 beta:

        Systems running NetBSD 1.6 BETAs and Release Candidates should
        be upgraded to the NetBSD 1.6 release.

        If a source-based point upgrade is required, sources from the
        NetBSD 1.6 branch dated 2002-08-11 or later should be used.

        The following directories need to be updated from the
        netbsd-1-6 CVS branch:
                crypto/Makefile.openssl
                crypto/dist/openssl
                lib/libcrypto
                lib/libssl

        To update from CVS, re-build, and re-install libcrypto and libssl:
                # cd src
                # cvs update -d -P -r netbsd-1-6 crypto/Makefile.openssl \
                        crypto/dist/openssl lib/libcrypto lib/libssl

                # make includes
                # cd lib/libcrypto
                # make cleandir dependall
                # make install
                # cd ../../lib/libssl
                # make cleandir dependall
                # make install

* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

        Systems running NetBSD-1.5.x dated from before 2002-08-31
        should be upgraded to NetBSD-1.5 branch dated 2002-08-31 or later.

        The following directories need to be updated from the
        netbsd-1-5 CVS branch. Due to the shlib major bump in libcrypto/libssl
        large number of shared libraries has to be rebuilt:
                crypto/Makefile.openssl
                crypto/dist/openssl
                lib/libasn1
                lib/libcom_err
                lib/libcrypto
                lib/libgssapi
                lib/libhdb
                lib/libkadm
                lib/libkadm5clnt
                lib/libkadm5srv
                lib/libkafs
                lib/libkdb
                lib/libkrb
                lib/libkrb5
                lib/libkstream
                lib/libroken
                lib/libsl
                lib/libss
                lib/libtelnet
                usr.bin/openssl

        All userland tools that use openssl needs to be rebuilt, due to the
        shlib major bump. Therefore, full rebuild is suggested. Make sure to
        rebuild all binaries installed by pkgsrc as well.

        To update from CVS, re-build, and re-install libcrypto and libssl:
                # cd src
                # cvs update -d -P -r netbsd-1-5 <directories listed above>

                # make build

* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:

        OpenSSL was not included in the base system in NetBSD-1.4.*
        Follow the directions for pkgsrc if you have installed it from
        pkgsrc.

* pkgsrc:

        openssl (pkgsrc/security/openssl) prior to 0.9.6f are
        vulnerable. Upgrade to openssl-0.9.6f or later; pkgsrc
        currently contains 0.9.6g at time of this writing.

        Packages which require openssl can be found by running 'pkg_info
        openssl'. Depending on the method you choose to update pkgsrc
        packages, a rebuild of the packages on that list may be
        performed for you by the package system. If you update using the
        experimental 'make replace' target, you will need to manually
        update any packages which build static binaries with libssl.a
        and libcrypto.a

        If you have statically linked binaries in pkgsrc, they have to be
        rebuilt. Statically linked binaries can be identified by the
        following command (note: be sure to include the directory you install
        pkgsrc binaries to, if you've changed LOCALBASE from the default of
        /usr/pkg)

                file /usr/pkg/{bin,sbin,libexec} | grep static

Thanks To
=========

A.L. Digital Ltd and John McDonald of Neohapsis.
Adi Stav and James Yonan.
CERT and the OpenSSL team.

Jun-ichiro itojun Hagino for maintenance of OpenSSL in the NetBSD
source tree, and preparing the initial advisory text.

The NetBSD Release Engineering teams, for great patience and
assistance in dealing with repeated security issues discovered
recently.

Revision History
================

        2002-08-01 Initial release based on 0.9.6e
        2002-08-11 based on 0.9.6f
        2002-08-31 1.5 pullup done, 0.9.6g
        2002-09-16 Re-release with updated information

More Information
================

An up-to-date PGP signed copy of this release will be maintained at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-009.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.

Copyright 2002, The NetBSD Foundation, Inc. All Rights Reserved.

$NetBSD: NetBSD-SA2002-009.txt,v 1.39 2002/09/23 01:57:19 itojun Exp $

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBPY51AD5Ru2/4N2IFAQEjJQP9GumaWgktTcobgsO+3Iq+x0Adg/fTMZ4r
hUPQNT1wTAFep9iSGJz+f8G4CvJjvbzplHhvcjPL14zbs+8U/cZhjeeLibJKgoCt
7Hwu9QLq12x0VlUoj0G1HJSQFKBO/+zFvCSxF1M/+pldOv6mfoEHygBM/xoRPHUI
z5G1Uv/irT8=
=ELua
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]