-----BEGIN PGP SIGNED MESSAGE----- NetBSD Security Advisory 2002-009 ================================= (updated 2002/9/22) Topic: Multiple vulnerabilities in OpenSSL code Version: NetBSD-current: source prior to August 10, 2002 NetBSD-1.6 beta: affected NetBSD-1.5.3: affected NetBSD-1.5.2: affected NetBSD-1.5.1: affected NetBSD-1.5: affected NetBSD-1.4.*: not applicable pkgsrc: prior to openssl-0.9.6f Severity: Potential for remote root exploit Fixed: NetBSD-current: August 10, 2002 NetBSD-1.6 branch: August 11, 2002 (1.6 includes the fix) NetBSD-1.5 branch: August 31, 2002 pkgsrc: openssl-0.9.6f (or later) NOTE: previous advisory had fixed dates prior to August 10. There were errors found in the vendor-supplied fix, therefore the fixed dates were modified. Sorry for the confusion and thanks for the patience. NOTE: previous revision of advisory suggested that 1.5 branch was fixed on August 1, however the fix was found to be insufficient. Therefore, users of 1.5 should apply the fix presented in this revised advisory. Sorry for the confusion and thanks for the patience. NOTE: previous revision of advisory suggested that 1.5 branch can be fixed by rebuilding part of the source code tree (shared library). However, it was incorrect. Follow the instruction below and perform a full build. Sorry for the confusion and thanks for the patience. Abstract ======== There are multiple vulnerabilities found in openssl 0.9.6e and prior releases. There are four remotely-exploitable buffer overruns in SSL2/3 code. The ASN1 parser can be confused by invalid encodings (SSL/TLS code affected). None of these services are enabled by default in NetBSD, however, by enabling services built with these libraries, a system would become vulnerable. - From the OpenSSL advisory: "Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or current development snapshots of 0.9.7 to provide SSL or TLS is vulnerable, whether client or server. 0.9.6d servers on 32-bit systems with SSL 2.0 disabled are not vulnerable." After the above advisory was published, - 0.9.6e was found to be vulnerable, and 0.9.6f was released. - 0.9.6f had some build framework errors, and 0.9.6g was released. The NetBSD fix includes OpenSSL 0.9.6g. Technical Details ================= http://www.openssl.org/news/secadv_20020730.txt http://CERT.Uni-Stuttgart.DE/advisories/c-integer-overflow.php Solutions and Workarounds ========================= The recent NetBSD 1.6 release is not vulnerable to this issue. A full upgrade to NetBSD 1.6 is the recommended resolution for all users able to do so. Many security-related improvements have been made, and indeed this release has been delayed several times in order to include fixes for a number of recent issues. The following instructions describe how to upgrade your libcrypto/libssl binaries by updating your source tree and rebuilding and installing a new version of libcrypto/libssl. Be sure to restart running instances of programs that use crypto libraries (like sshd) after upgrading shared libraries. If you have any statically-linked binaries that linked against a vulnerable libcrypto and/or libssl, you need to recompile them. * NetBSD-current: Systems running NetBSD-current dated from before 2002-08-10 should be upgraded to NetBSD-current dated 2002-08-10 or later. The following directories need to be updated from the netbsd-current CVS branch (aka HEAD): crypto/Makefile.openssl crypto/dist/openssl lib/libcrypto lib/libssl To update from CVS, re-build, and re-install libcrypto and libssl: # cd src # cvs update -d -P crypto/Makefile.openssl crypto/dist/openssl \ lib/libcrypto lib/libssl # make includes # cd lib/libcrypto # make cleandir dependall # make install # cd ../../lib/libssl # make cleandir dependall # make install * NetBSD 1.6 beta: Systems running NetBSD 1.6 BETAs and Release Candidates should be upgraded to the NetBSD 1.6 release. If a source-based point upgrade is required, sources from the NetBSD 1.6 branch dated 2002-08-11 or later should be used. The following directories need to be updated from the netbsd-1-6 CVS branch: crypto/Makefile.openssl crypto/dist/openssl lib/libcrypto lib/libssl To update from CVS, re-build, and re-install libcrypto and libssl: # cd src # cvs update -d -P -r netbsd-1-6 crypto/Makefile.openssl \ crypto/dist/openssl lib/libcrypto lib/libssl # make includes # cd lib/libcrypto # make cleandir dependall # make install # cd ../../lib/libssl # make cleandir dependall # make install * NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3: Systems running NetBSD-1.5.x dated from before 2002-08-31 should be upgraded to NetBSD-1.5 branch dated 2002-08-31 or later. The following directories need to be updated from the netbsd-1-5 CVS branch. Due to the shlib major bump in libcrypto/libssl large number of shared libraries has to be rebuilt: crypto/Makefile.openssl crypto/dist/openssl lib/libasn1 lib/libcom_err lib/libcrypto lib/libgssapi lib/libhdb lib/libkadm lib/libkadm5clnt lib/libkadm5srv lib/libkafs lib/libkdb lib/libkrb lib/libkrb5 lib/libkstream lib/libroken lib/libsl lib/libss lib/libtelnet usr.bin/openssl All userland tools that use openssl needs to be rebuilt, due to the shlib major bump. Therefore, full rebuild is suggested. Make sure to rebuild all binaries installed by pkgsrc as well. To update from CVS, re-build, and re-install libcrypto and libssl: # cd src # cvs update -d -P -r netbsd-1-5 <directories listed above> # make build * NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3: OpenSSL was not included in the base system in NetBSD-1.4.* Follow the directions for pkgsrc if you have installed it from pkgsrc. * pkgsrc: openssl (pkgsrc/security/openssl) prior to 0.9.6f are vulnerable. Upgrade to openssl-0.9.6f or later; pkgsrc currently contains 0.9.6g at time of this writing. Packages which require openssl can be found by running 'pkg_info openssl'. Depending on the method you choose to update pkgsrc packages, a rebuild of the packages on that list may be performed for you by the package system. If you update using the experimental 'make replace' target, you will need to manually update any packages which build static binaries with libssl.a and libcrypto.a If you have statically linked binaries in pkgsrc, they have to be rebuilt. Statically linked binaries can be identified by the following command (note: be sure to include the directory you install pkgsrc binaries to, if you've changed LOCALBASE from the default of /usr/pkg) file /usr/pkg/{bin,sbin,libexec} | grep static Thanks To ========= A.L. Digital Ltd and John McDonald of Neohapsis. Adi Stav and James Yonan. CERT and the OpenSSL team. Jun-ichiro itojun Hagino for maintenance of OpenSSL in the NetBSD source tree, and preparing the initial advisory text. The NetBSD Release Engineering teams, for great patience and assistance in dealing with repeated security issues discovered recently. Revision History ================ 2002-08-01 Initial release based on 0.9.6e 2002-08-11 based on 0.9.6f 2002-08-31 1.5 pullup done, 0.9.6g 2002-09-16 Re-release with updated information More Information ================ An up-to-date PGP signed copy of this release will be maintained at ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-009.txt.asc Information about NetBSD and NetBSD security can be found at http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/. Copyright 2002, The NetBSD Foundation, Inc. All Rights Reserved. $NetBSD: NetBSD-SA2002-009.txt,v 1.39 2002/09/23 01:57:19 itojun Exp $ -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAwUBPY51AD5Ru2/4N2IFAQEjJQP9GumaWgktTcobgsO+3Iq+x0Adg/fTMZ4r hUPQNT1wTAFep9iSGJz+f8G4CvJjvbzplHhvcjPL14zbs+8U/cZhjeeLibJKgoCt 7Hwu9QLq12x0VlUoj0G1HJSQFKBO/+zFvCSxF1M/+pldOv6mfoEHygBM/xoRPHUI z5G1Uv/irT8= =ELua -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Mon Sep 23 2002 - 12:54:43 PDT