OpenSSL安全公告高危漏洞可以对默认配置的服务器发动DDoS攻击-阿里云开发者社区

OpenSSL项目组在今天发布高威胁安全通告CVE-2016-6304，更新内容包括：修复了自2016年5月以来的安全漏洞，其中包括一个高危漏洞，一个为“中危”，其余均评级为“低危”。OpenSSL安全公告 [22 Sep 2016]公告如下：

OCSP状态请求扩展跨内存边界增长(CVE-2016-6304)

安全等级: 高危

恶意的客户端可以发送过大的OCSP状态请求延期。如果该客户端不断请求重新谈判，发送一个大的 OCSP 状态请求每延长一次，那么就会有无限的内存增长在服务器上。这最终将导致通过内存耗尽的拒绝服务攻击。这种攻击在使用默认配置的服务器上很容易执行，即使他们不支持 OCSP。建立使用"无 ocsp"生成时间选项不会受到影响。

Servers using OpenSSL versions prior to 1.0.1g are not vulnerable in a default configuration, instead only if an application explicitly enables OCSP stapling support.

OpenSSL 1.1.0 应该升级到 1.1.0a
OpenSSL 1.0.2 应该升级到 1.0.2i
OpenSSL 1.0.1 应该升级到 1.0.1u

SSL_peek() hang on empty record (CVE-2016-6305)
===============================================

安全等级：中

攻击者可以通过发送一个空记录，从而在调用SSL_peek()函数时引起拒绝服务。

OpenSSL 1.1.0 SSL/TLS will hang during a call to SSL_peek() if the peer sends an
empty record. This could be exploited by a malicious peer in a Denial Of Service
attack.

OpenSSL 1.1.0 users should upgrade to 1.1.0a

This issue was reported to OpenSSL on 10th September 2016 by Alex Gaynor. The
fix was developed by Matt Caswell of the OpenSSL development team.

SWEET32 Mitigation (CVE-2016-2183)
==================================

安全等级：低

该漏洞涉及SWEET32攻击，一种针对64位分组密码算法的生日攻击。

SWEET32 (https://sweet32.info) is an attack on older block cipher algorithms
that use a block size of 64 bits. In mitigation for the SWEET32 attack DES based
ciphersuites have been moved from the HIGH cipherstring group to MEDIUM in
OpenSSL 1.0.1 and OpenSSL 1.0.2. OpenSSL 1.1.0 since release has had these
ciphersuites disabled by default.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 16th August 2016 by Karthikeyan
Bhargavan and Gaetan Leurent (INRIA). The fix was developed by Rich Salz of the
OpenSSL development team.

OOB write in MDC2_Update() (CVE-2016-6303)
==========================================

安全等级：低

该漏洞是存在于函数MDC2_Update()中的一个整数溢出，导致内存破坏，进而允许拒绝服务攻击

An overflow can occur in MDC2_Update() either if called directly or
through the EVP_DigestUpdate() function using MDC2. If an attacker
is able to supply very large amounts of input data after a previous
call to EVP_EncryptUpdate() with a partial block then a length check
can overflow resulting in a heap corruption.

The amount of data needed is comparable to SIZE_MAX which is impractical
on most platforms.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Malformed SHA512 ticket DoS (CVE-2016-6302)
===========================================

安全等级：低

该漏洞是存在于函数MDC2_Update()中的一个整数溢出，导致内存破坏，进而允许拒绝服务攻击

If a server uses SHA512 for TLS session ticket HMAC it is vulnerable to a
DoS attack where a malformed ticket will result in an OOB read which will
ultimately crash.

The use of SHA512 in TLS session tickets is comparatively rare as it requires
a custom server callback and ticket lookup mechanism.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

OOB write in BN_bn2dec() (CVE-2016-2182)
========================================

安全等级：低

位于crypto/bn/bn_print.c的函数BN_bn2dec（）没有检验BN_div_word()函数的返回值，允许内存越界写入，从而引起拒绝服务

The function BN_bn2dec() does not check the return value of BN_div_word().
This can cause an OOB write if an application uses this function with an
overly large BIGNUM. This could be a problem if an overly large certificate
or CRL is printed out from an untrusted source. TLS is not affected because
record limits will reject an oversized certificate before it is parsed.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

OOB read in TS_OBJ_print_bio() (CVE-2016-2180)
==============================================

安全等级：低

位于crypto/ts/ts_lib.c中的函数TS_OBJ_print_bio()存在越界写入问题，允许拒绝服务

The function TS_OBJ_print_bio() misuses OBJ_obj2txt(): the return value is
the total length the OID text representation would use and not the amount
of data written. This will result in OOB reads when large OIDs are presented.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Pointer arithmetic undefined behaviour (CVE-2016-2177)
======================================================

安全等级：低

在计算堆缓冲区的边界时出错，允许攻击者发起拒绝服务攻击

Avoid some undefined pointer arithmetic

A common idiom in the codebase is to check limits in the following manner:
"p + len > limit"

Where "p" points to some malloc'd data of SIZE bytes and
limit == p + SIZE

"len" here could be from some externally supplied data (e.g. from a TLS
message).

The rules of C pointer arithmetic are such that "p + len" is only well
defined where len <= SIZE. Therefore the above idiom is actually
undefined behaviour.

For example this could cause problems if some malloc implementation
provides an address for "p" such that "p + len" actually overflows for
values of len that are too big and therefore p + len < limit.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 4th May 2016 by Guido Vranken. The
fix was developed by Matt Caswell of the OpenSSL development team.

Constant time flag not preserved in DSA signing (CVE-2016-2178)
===============================================================

安全等级：低

位于crypto/dsa/dsa_ossl.c中的函数dsa_sign_setup()，没有正确处理constant-time，允许攻击者通过边信道攻击获得DSA的私钥

Operations in the DSA signing algorithm should run in constant time in order to
avoid side channel attacks. A flaw in the OpenSSL DSA implementation means that
a non-constant time codepath is followed for certain operations. This has been
demonstrated through a cache-timing attack to be sufficient for an attacker to
recover the private DSA key.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 23rd May 2016 by César Pereida (Aalto
University), Billy Brumley (Tampere University of Technology), and Yuval Yarom
(The University of Adelaide and NICTA). The fix was developed by César Pereida.

DTLS buffered message DoS (CVE-2016-2179)
=========================================

安全等级：低

在DTLS的实现中，没有正确处理未按序到达的握手消息缓存，允许攻击者同时维护多个精心构造的DTLS会话，导致拒绝服务

In a DTLS connection where handshake messages are delivered out-of-order those
messages that OpenSSL is not yet ready to process will be buffered for later
use. Under certain circumstances, a flaw in the logic means that those messages
do not get removed from the buffer even though the handshake has been completed.
An attacker could force up to approx. 15 messages to remain in the buffer when
they are no longer required. These messages will be cleared when the DTLS
connection is closed. The default maximum size for a message is 100k. Therefore
the attacker could force an additional 1500k to be consumed per connection. By
opening many simulataneous connections an attacker could cause a DoS attack
through memory exhaustion.

OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 22nd June 2016 by Quan Luo. The fix was
developed by Matt Caswell of the OpenSSL development team.

DTLS replay protection DoS (CVE-2016-2181)
==========================================

安全等级：低

在DTLS的实现中，没有正确处理未按序到达的握手消息缓存，允许攻击者同时维护多个精心构造的DTLS会话，导致拒绝服务

A flaw in the DTLS replay attack protection mechanism means that records that
arrive for future epochs update the replay protection "window" before the MAC
for the record has been validated. This could be exploited by an attacker by
sending a record for the next epoch (which does not have to decrypt or have a
valid MAC), with a very large sequence number. This means that all subsequent
legitimate packets are dropped causing a denial of service for a specific
DTLS connection.

OpenSSL 1.0.2 DTLS users should upgrade to 1.0.2i
OpenSSL 1.0.1 DTLS users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 21st November 2015 by the OCAP audit team.
The fix was developed by Matt Caswell of the OpenSSL development team.

Certificate message OOB reads (CVE-2016-6306)
=============================================

安全等级：低

在OpenSSL的1.0.2及更早版本中，缺少对一些消息长度的校验，导致内存越界读取，在理论上允许拒绝服务攻击

In OpenSSL 1.0.2 and earlier some missing message length checks can result in
OOB reads of up to 2 bytes beyond an allocated buffer. There is a theoretical
DoS risk but this has not been observed in practice on common platforms.

The messages affected are client certificate, client certificate request and
server certificate. As a result the attack can only be performed against
a client or a server which enables client authentication.

OpenSSL 1.1.0 is not affected.

OpenSSL 1.0.2 users should upgrade to 1.0.2i
OpenSSL 1.0.1 users should upgrade to 1.0.1u

Excessive allocation of memory in tls_get_message_header() (CVE-2016-6307)
==========================================================================

安全等级：低

tls_get_message_header()函数存在检查缺陷，导致攻击者可以通过精心构造的数据包，使内存过度分配，进而借此大量消耗服务器的内存导致拒绝服务

A TLS message includes 3 bytes for its length in the header for the message.
This would allow for messages up to 16Mb in length. Messages of this length are
excessive and OpenSSL includes a check to ensure that a peer is sending
reasonably sized messages in order to avoid too much memory being consumed to
service a connection. A flaw in the logic of version 1.1.0 means that memory for
the message is allocated too early, prior to the excessive message length
check. Due to way memory is allocated in OpenSSL this could mean an attacker
could force up to 21Mb to be allocated to service a connection. This could lead
to a Denial of Service through memory exhaustion. However, the excessive message
length check still takes place, and this would cause the connection to
immediately fail. Assuming that the application calls SSL_free() on the failed
conneciton in a timely manner then the 21Mb of allocated memory will then be
immediately freed again. Therefore the excessive memory allocation will be
transitory in nature. This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the
event that the connection fails
or
2) The application is working in a constrained environment where there
is very little free memory
or
3) The attacker initiates multiple connection attempts such that there
are multiple connections in a state where memory has been allocated for
the connection; SSL_free() has not yet been called; and there is
insufficient memory to service the multiple requests.

Except in the instance of (1) above any Denial Of Service is likely to
be transitory because as soon as the connection fails the memory is
subsequently freed again in the SSL_free() call. However there is an
increased risk during this period of application crashes due to the lack
of memory - which would then mean a more serious Denial of Service.

This issue does not affect DTLS users.

OpenSSL 1.1.0 TLS users should upgrade to 1.1.0a

Excessive allocation of memory in dtls1_preprocess_fragment() (CVE-2016-6308)
=============================================================================

安全等级：低

dtls1_preprocess_fragment()存在检查缺陷，导致服务器的内存可以过度分配，进而以前拒绝服务攻击

This issue is very similar to CVE-2016-6307. The underlying defect is different
but the security analysis and impacts are the same except that it impacts DTLS.

A DTLS message includes 3 bytes for its length in the header for the message.
This would allow for messages up to 16Mb in length. Messages of this length are
excessive and OpenSSL includes a check to ensure that a peer is sending
reasonably sized messages in order to avoid too much memory being consumed to
service a connection. A flaw in the logic of version 1.1.0 means that memory for
the message is allocated too early, prior to the excessive message length
check. Due to way memory is allocated in OpenSSL this could mean an attacker
could force up to 21Mb to be allocated to service a connection. This could lead
to a Denial of Service through memory exhaustion. However, the excessive message
length check still takes place, and this would cause the connection to
immediately fail. Assuming that the application calls SSL_free() on the failed
conneciton in a timely manner then the 21Mb of allocated memory will then be
immediately freed again. Therefore the excessive memory allocation will be
transitory in nature. This then means that there is only a security impact if:

1) The application does not call SSL_free() in a timely manner in the event that the connection fails
2) The application is working in a constrained environment where there is very little free memory
3) The attacker initiates multiple connection attempts such that there are multiple connections in a state where memory has been allocated for the connection; SSL_free() has not yet been called; and there is insufficient memory to service the multiple requests.

This issue does not affect TLS users.

OpenSSL 1.1.0 DTLS users should upgrade to 1.1.0a

声明

As per our previous announcements and our Release Strategy (https://www.openssl.org/policies/releasestrat.html), support for OpenSSL version 1.0.1 will cease on 31st December 2016. No security updates for that version will be provided after that date. Users of 1.0.1 are advised to upgrade.

Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates.

参考信息

URL for this Security Advisory:
https://www.openssl.org/news/secadv/20160922.txt

Note: the online version of the advisory may be updated with additional details
over time.

For details of OpenSSL severity classifications please see:
https://www.openssl.org/policies/secpolicy.html

原文发布时间：2017年3月24日

本文由：安全加发布，版权归属于原作者

原文链接：http://toutiao.secjia.com/openssl-security-advisory-cve-2016-6304

本文来自云栖社区合作伙伴安全加，了解相关信息可以关注安全加网站