OpenSSL安全公告高危漏洞 可以对默认配置的服务器发动DDoS攻击

简介:

OpenSSL项目组在今天发布高威胁安全通告CVE-2016-6304,更新内容包括:修复了自2016年5月以来的安全漏洞,其中包括一个高危漏洞,一个为“中危”,其余均评级为“低危”。OpenSSL安全公告 [22 Sep 2016]公告如下:

OCSP状态请求扩展跨内存边界增长(CVE-2016-6304)

安全等级: 高危

恶意的客户端可以发送过大的OCSP状态请求延期。如果该客户端不断请求重新谈判,发送一个大的 OCSP 状态请求每延长一次,那么就会有无限的内存增长在服务器上。这最终将导致通过内存耗尽的拒绝服务攻击。这种攻击在使用默认配置的服务器上很容易执行,即使他们不支持 OCSP。建立使用"无 ocsp"生成时间选项不会受到影响。

Servers using OpenSSL versions prior to 1.0.1g are not vulnerable in a default configuration, instead only if an application explicitly enables OCSP stapling support.

OpenSSL 1.1.0 应该升级到 1.1.0a 
OpenSSL 1.0.2 应该升级到 1.0.2i 
OpenSSL 1.0.1 应该升级到 1.0.1u

SSL_peek() hang on empty record (CVE-2016-6305) 
===============================================

安全等级:中

攻击者可以通过发送一个空记录,从而在调用SSL_peek()函数时引起拒绝服务。

OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer sends an 
empty record. This could be exploited by a malicious peer in a Denial Of Service 
attack.

OpenSSL 1.1.0 users should upgrade to 1.1.0a

This issue was reported to OpenSSL on 10th September 2016 by Alex Gaynor. The 
fix was developed by Matt Caswell of the OpenSSL development team.

SWEET32 Mitigation (CVE-2016-2183) 
==================================

安全等级:低

该漏洞涉及SWEET32攻击,一种针对64位分组密码算法的生日攻击。

SWEET32 (https://sweet32.info) is an attack on older block cipher algorithms 
that use a block size of 64 bits. In mitigation for the SWEET32 attack DES based 
ciphersuites have been moved from the HIGH cipherstring group to MEDIUM in 
OpenSSL 1.0.1 and OpenSSL 1.0.2.  OpenSSL 1.1.0 since release has had these 
ciphersuites disabled by default.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 16th August 2016 by Karthikeyan 
Bhargavan and Gaetan Leurent (INRIA). The fix was developed by Rich Salz of the 
OpenSSL development team.

OOB write in MDC2_Update() (CVE-2016-6303) 
==========================================

安全等级:低

该漏洞是存在于函数MDC2_Update()中的一个整数溢出,导致内存破坏,进而允许拒绝服务攻击

An overflow can occur in MDC2_Update() either if called directly or 
through the EVP_DigestUpdate() function using MDC2. If an attacker 
is able to supply very large amounts of input data after a previous 
call to EVP_EncryptUpdate() with a partial block then a length check 
can overflow resulting in a heap corruption.

The amount of data needed is comparable to SIZE_MAX which is impractical 
on most platforms.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Malformed SHA512 ticket DoS (CVE-2016-6302) 
===========================================

安全等级:低

该漏洞是存在于函数MDC2_Update()中的一个整数溢出,导致内存破坏,进而允许拒绝服务攻击

If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a 
DoS attack where a malformed ticket will result in an OOB read which will 
ultimately crash.

The use of SHA512 in TLS session tickets is comparatively rare as it requires 
a custom server callback and ticket lookup mechanism.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

OOB write in BN_bn2dec() (CVE-2016-2182) 
========================================

安全等级:低

位于crypto/bn/bn_print.c的函数BN_bn2dec()没有检验BN_div_word()函数的返回值,允许内存越界写入,从而引起拒绝服务

The function BN_bn2dec() does not check the return value of BN_div_word(). 
This can cause an OOB write if an application uses this function with an 
overly large BIGNUM. This could be a problem if an overly large certificate 
or CRL is printed out from an untrusted source. TLS is not affected because 
record limits will reject an oversized certificate before it is parsed.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

OOB read in TS_OBJ_print_bio() (CVE-2016-2180) 
==============================================

安全等级:低

位于crypto/ts/ts_lib.c中的函数TS_OBJ_print_bio()存在越界写入问题,允许拒绝服务

The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is 
the total length the OID text representation would use and not the amount 
of data written. This will result in OOB reads when large OIDs are presented.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Pointer arithmetic undefined behaviour (CVE-2016-2177) 
======================================================

安全等级:低

在计算堆缓冲区的边界时出错,允许攻击者发起拒绝服务攻击

Avoid some undefined pointer arithmetic

A common idiom in the codebase is to check limits in the following manner: 
"p + len > limit"

Where "p" points to some malloc'd data of SIZE bytes and 
limit == p + SIZE

"len" here could be from some externally supplied data (e.g. from a TLS 
message).

The rules of C pointer arithmetic are such that "p + len" is only well 
defined where len <= SIZE. Therefore the above idiom is actually 
undefined behaviour.

For example this could cause problems if some malloc implementation 
provides an address for "p" such that "p + len" actually overflows for 
values of len that are too big and therefore p + len < limit.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 4th May 2016 by Guido Vranken. The 
fix was developed by Matt Caswell of the OpenSSL development team.

Constant time flag not preserved in DSA signing (CVE-2016-2178) 
===============================================================

安全等级:低

位于crypto/dsa/dsa_ossl.c中的函数dsa_sign_setup(),没有正确处理constant-time,允许攻击者通过边信道攻击获得DSA的私钥

Operations in the DSA signing algorithm should run in constant time in order to 
avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that 
a non-constant time codepath is followed for certain operations. This has been 
demonstrated through a cache-timing attack to be sufficient for an attacker to 
recover the private DSA key.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 23rd May 2016 by César Pereida (Aalto 
University), Billy Brumley (Tampere University of Technology), and Yuval Yarom 
(The University of Adelaide and NICTA). The fix was developed by César Pereida.

DTLS buffered message DoS (CVE-2016-2179) 
=========================================

安全等级:低

在DTLS的实现中,没有正确处理未按序到达的握手消息缓存,允许攻击者同时维护多个精心构造的DTLS会话,导致拒绝服务

In a DTLS connection where handshake messages are delivered out-of-order those 
messages that OpenSSL is not yet ready to process will be buffered for later 
use. Under certain circumstances, a flaw in the logic means that those messages 
do not get removed from the buffer even though the handshake has been completed. 
An attacker could force up to approx. 15 messages to remain in the buffer when 
they are no longer required. These messages will be cleared when the DTLS 
connection is closed. The default maximum size for a message is 100k. Therefore 
the attacker could force an additional 1500k to be consumed per connection. By 
opening many simulataneous connections an attacker could cause a DoS attack 
through memory exhaustion.

OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i 
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 22nd June 2016 by Quan Luo. The fix was 
developed by Matt Caswell of the OpenSSL development team.

DTLS replay protection DoS (CVE-2016-2181) 
==========================================

安全等级:低

在DTLS的实现中,没有正确处理未按序到达的握手消息缓存,允许攻击者同时维护多个精心构造的DTLS会话,导致拒绝服务

A flaw in the DTLS replay attack protection mechanism means that records that 
arrive for future epochs update the replay protection "window" before the MAC 
for the record has been validated. This could be exploited by an attacker by 
sending a record for the next epoch (which does not have to decrypt or have a 
valid MAC), with a very large sequence number. This means that all subsequent 
legitimate packets are dropped causing a denial of service for a specific 
DTLS connection.

OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i 
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 21st November 2015 by the OCAP audit team. 
The fix was developed by Matt Caswell of the OpenSSL development team.

Certificate message OOB reads (CVE-2016-6306) 
=============================================

安全等级:低

在OpenSSL的1.0.2及更早版本中,缺少对一些消息长度的校验,导致内存越界读取,在理论上允许拒绝服务攻击

In OpenSSL 1.0.2 and earlier some missing message length checks can result in 
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical 
DoS risk but this has not been observed in practice on common platforms.

The messages affected are client certificate, client certificate request and 
server certificate. As a result the attack can only be performed against 
a client or a server which enables client authentication.

OpenSSL 1.1.0 is not affected.

OpenSSL 1.0.2 users should upgrade to 1.0.2i 
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Excessive allocation of memory in tls_get_message_header() (CVE-2016-6307) 
==========================================================================

安全等级:低

tls_get_message_header()函数存在检查缺陷,导致攻击者可以通过精心构造的数据包,使内存过度分配,进而借此大量消耗服务器的内存导致拒绝服务

A TLS message includes 3 bytes for its length in the header for the message. 
This would allow for messages up to 16Mb in length. Messages of this length are 
excessive and OpenSSL includes a check to ensure that a peer is sending 
reasonably sized messages in order to avoid too much memory being consumed to 
service a connection. A flaw in the logic of version 1.1.0 means that memory for 
the message is allocated too early, prior to the excessive message length 
check. Due to way memory is allocated in OpenSSL this could mean an attacker 
could force up to 21Mb to be allocated to service a connection. This could lead 
to a Denial of Service through memory exhaustion. However, the excessive message 
length check still takes place, and this would cause the connection to 
immediately fail. Assuming that the application calls SSL_free() on the failed 
conneciton in a timely manner then the 21Mb of allocated memory will then be 
immediately freed again. Therefore the excessive memory allocation will be 
transitory in nature. This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the 
event that the connection fails 
or 
2) The application is working in a constrained environment where there 
is very little free memory 
or 
3) The attacker initiates multiple connection attempts such that there 
are multiple connections in a state where memory has been allocated for 
the connection; SSL_free() has not yet been called; and there is 
insufficient memory to service the multiple requests.

Except in the instance of (1) above any Denial Of Service is likely to 
be transitory because as soon as the connection fails the memory is 
subsequently freed again in the SSL_free() call. However there is an 
increased risk during this period of application crashes due to the lack 
of memory - which would then mean a more serious Denial of Service.

This issue does not affect DTLS users.

OpenSSL 1.1.0 TLS users should upgrade to 1.1.0a

Excessive allocation of memory in dtls1_preprocess_fragment() (CVE-2016-6308) 
=============================================================================

安全等级:低

dtls1_preprocess_fragment()存在检查缺陷,导致服务器的内存可以过度分配,进而以前拒绝服务攻击

This issue is very similar to CVE-2016-6307. The underlying defect is different 
but the security analysis and impacts are the same except that it impacts DTLS.

A DTLS message includes 3 bytes for its length in the header for the message. 
This would allow for messages up to 16Mb in length. Messages of this length are 
excessive and OpenSSL includes a check to ensure that a peer is sending 
reasonably sized messages in order to avoid too much memory being consumed to 
service a connection. A flaw in the logic of version 1.1.0 means that memory for 
the message is allocated too early, prior to the excessive message length 
check. Due to way memory is allocated in OpenSSL this could mean an attacker 
could force up to 21Mb to be allocated to service a connection. This could lead 
to a Denial of Service through memory exhaustion. However, the excessive message 
length check still takes place, and this would cause the connection to 
immediately fail. Assuming that the application calls SSL_free() on the failed 
conneciton in a timely manner then the 21Mb of allocated memory will then be 
immediately freed again. Therefore the excessive memory allocation will be 
transitory in nature. This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the event that the connection fails 
2) The application is working in a constrained environment where there is very little free memory 
3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL_free() has not yet been called; and there is insufficient memory to service the multiple requests.

Except in the instance of (1) above any Denial Of Service is likely to 
be transitory because as soon as the connection fails the memory is 
subsequently freed again in the SSL_free() call. However there is an 
increased risk during this period of application crashes due to the lack 
of memory - which would then mean a more serious Denial of Service.

This issue does not affect TLS users.

OpenSSL 1.1.0 DTLS users should upgrade to 1.1.0a

声明

As per our previous announcements and our Release Strategy (https://www.openssl.org/policies/releasestrat.html), support for OpenSSL version 1.0.1 will cease on 31st December 2016. No security updates for that version will be provided after that date. Users of 1.0.1 are advised to upgrade.

Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates.

参考信息

URL for this Security Advisory: 
https://www.openssl.org/news/secadv/20160922.txt

Note: the online version of the advisory may be updated with additional details 
over time.

For details of OpenSSL severity classifications please see: 
https://www.openssl.org/policies/secpolicy.html



原文发布时间:2017年3月24日

本文由:安全加 发布,版权归属于原作者

原文链接:http://toutiao.secjia.com/openssl-security-advisory-cve-2016-6304

本文来自云栖社区合作伙伴安全加,了解相关信息可以关注安全加网站

相关文章
|
4天前
|
存储 弹性计算 大数据
阿里云服务器38元、99元、199元特惠详细配置、适用场景及购买条件介绍
阿里云特惠云服务器全解析:入门款:轻量应用服务器(2核2G200M带宽+40G ESSD盘)38元/年,日均0.1元。进阶款:经济型e实例(2核2G3M带宽+40G ESSD Entry盘)99元/年,续费同价。性能款:通用算力型u1实例(2核4G5M带宽+80G ESSD Entry盘)199元/年,企业独享,续费同价。三款配置覆盖个人建站、中小企业应用及轻量级企业服务,通过大数据精选用户常用配置,实现价格与性能的精准匹配。本文将详细解析这些阿里云服务器的配置、价格、限购条件以及购买指南,帮助大家更好地了解和选择适合自己的云服务器。
|
1月前
|
机器学习/深度学习 弹性计算 编解码
阿里云服务器4核8G配置:ECS实例规格、CPU型号及使用场景说明
阿里云4核8G服务器ECS提供多种实例规格,包括高主频计算型hfc8i、计算型c8i、通用算力型u1、经济型e等。各规格配备不同CPU型号与主频性能,适用于机器学习、数据分析、游戏服务器、Web前端等多种场景。用户可根据需求选择Intel或AMD处理器,如第四代Xeon或AMD EPYC系列,满足高性能计算及企业级应用要求。更多详情参见阿里云官方文档。
159 1
|
2天前
|
弹性计算 网络协议 安全
【转】如何配置服务器的端口映射?
本文详解端口映射原理及配置方法,涵盖家庭、企业与云环境,包含静态、动态与双向映射类型,并提供常见问题解决方案。
62 6
|
17天前
|
Windows
Windows下版本控制器(SVN)-验证是否安装成功+配置版本库+启动服务器端程序
Windows下版本控制器(SVN)-验证是否安装成功+配置版本库+启动服务器端程序
34 2
|
10天前
|
存储 固态存储 安全
阿里云服务器最新租用价格:收费标准与2核4G/4核8G等热门配置活动价格参考
阿里云服务器租用价格是多少?阿里云服务器报价主要看所选云服务器的实例规格与带宽和云盘等配置,现在购买阿里云服务器,轻量应用服务器2核2G200M带宽38元1年,经济型e实例2核2G3M带宽99元1年,通用算力型u1实例2核4G5M带宽199元1年。本文为大家展示阿里云服务器最新的收费标准与活动价格情况,以供了解和参考。
|
1月前
|
机器学习/深度学习 弹性计算 编解码
阿里云服务器4核8G配置:ECS实例规格、CPU型号及使用场景说明
阿里云4核8G服务器ECS提供多种实例规格,如高主频计算型hfc8i、计算型c8i、通用算力型u1、经济型e等。各规格基于不同CPU型号与主频性能设计,适用于机器学习、数据分析、游戏服务器、网站应用等多种场景。用户可根据实际需求选择适合的配置,满足高性能计算或经济性要求。更多详情及参数说明可参考官方文档。
328 4
|
1月前
|
弹性计算 数据挖掘 测试技术
阿里云服务器2核8G、4核16G、8核32G配置热门实例性能、适用场景对于与选择参考
2025年,阿里云针对2核8G、4核16G、8核32G这三种主流配置,推出了一系列极具吸引力的活动,为用户提供了多样化的选择。目前,2核8G配置的云服务器活动价格为522.79元/年起,4核16G配置的云服务器活动价格为2149.92元/年起,而8核32G配置的云服务器活动价格则为4249.44元/年起。这些价格涵盖了经济型e、通用算力型u1、通用型g8i、通用型g7和通用型g8y等不同实例规格,为用户提供了多样化的选择。本文将对这些配置热门实例规格的实例性能、适用场景和活动价格做个对比,以供选择和参考。
|
23天前
|
数据采集 人工智能 BI
MyEMS能源管理系统后台配置-邮件服务器设置
本文介绍其邮件服务器配置方法。
23 0
|
2月前
|
存储 弹性计算 应用服务中间件
阿里云服务器2核4G、4核8G、8核16G配置主要适用场景及最新活动价格参考
云服务器现在已成为企业和个人开展业务、搭建应用不可或缺的基础设施,在众多配置中,2核4G、4核8G和8核16G是广大用户选择较多的配置,目前阿里云服务器通用算力型u1实例2核4G5M带宽企业用户购买的价格只要199元1年,且续费价格不变,4核8G目前的活动价格为955.58元1年起,8核16G配置选择计算型c8y实例的活动价格为3815.03元1年起。本文将为大家解析2025年截止目前阿里云服务器中2核4G、4核8G、8核16G配置的活动报价,帮助用户了解最新价格信息,以及不同配置的主要适用场景,以供参考和选择。
|
2月前
|
存储 弹性计算 安全
阿里云服务器38元、99元、199元配置、适用场景区别及选择参考
目前,阿里云有多款特价云服务器产品,轻量云服务器2核2G200M峰值带宽38元一年,经济型e实例云服务器2核2G3M带宽99元1年、4核16G10M云服务器70元1个月、210元3个月,8核32G10M带宽160元1个月、480元3个月,通用算力型u1实例2核4G5M带宽199元一年、4核8G云服务器955元一年。本文将详细介绍阿里云的三款特价云服务器产品:38元的轻量应用服务器、99元的云服务器ECS经济型e实例,以及199元的云服务器ECS u1实例,帮助用户更好地了解这些产品的规格、配置、适用场景及购买资格和注意事项。

热门文章

最新文章