Commit 208a6012 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Fix various certificate fingerprint issues. 



By using non-DER or invalid encodings outside the signed portion of a
certificate the fingerprint can be changed without breaking the signature.
Although no details of the signed portion of the certificate can be changed
this can cause problems with some applications: e.g. those using the
certificate fingerprint for blacklists.

1. Reject signatures with non zero unused bits.

If the BIT STRING containing the signature has non zero unused bits reject
the signature. All current signature algorithms require zero unused bits.

2. Check certificate algorithm consistency.

Check the AlgorithmIdentifier inside TBS matches the one in the
certificate signature. NB: this will result in signature failure
errors for some broken certificates.

3. Check DSA/ECDSA signatures use DER.

Reencode DSA/ECDSA signatures and compare with the original received
signature. Return an error if there is a mismatch.

This will reject various cases including garbage after signature
(thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS
program for discovering this case) and use of BER or invalid ASN.1 INTEGERs
(negative or with leading zeroes).

CVE-2014-8275
Reviewed-by: default avatarEmilia Käsper <emilia@openssl.org>

(cherry picked from commit 684400ce)

Conflicts:
	CHANGES
	crypto/dsa/dsa_asn1.c
parent d7f8a7ca

CHANGES

+36 −1
Original line number Diff line number Diff line
@@ -4,7 +4,42 @@ 


 Changes between 1.0.0o and 1.0.0p [xx XXX xxxx]



  *)

  *) Fix various certificate fingerprint issues.



     By using non-DER or invalid encodings outside the signed portion of a

     certificate the fingerprint can be changed without breaking the signature.

     Although no details of the signed portion of the certificate can be changed

     this can cause problems with some applications: e.g. those using the

     certificate fingerprint for blacklists.



     1. Reject signatures with non zero unused bits.



     If the BIT STRING containing the signature has non zero unused bits reject

     the signature. All current signature algorithms require zero unused bits.



     2. Check certificate algorithm consistency.



     Check the AlgorithmIdentifier inside TBS matches the one in the

     certificate signature. NB: this will result in signature failure

     errors for some broken certificates.



     Thanks to Konrad Kraszewski from Google for reporting this issue.



     3. Check DSA/ECDSA signatures use DER.



     Reencode DSA/ECDSA signatures and compare with the original received

     signature. Return an error if there is a mismatch.



     This will reject various cases including garbage after signature

     (thanks to Antti Karjalainen and Tuomo Untinen from the Codenomicon CROSS

     program for discovering this case) and use of BER or invalid ASN.1 INTEGERs

     (negative or with leading zeroes).



     Further analysis was conducted and fixes were developed by Stephen Henson

     of the OpenSSL core team.



     (CVE-2014-8275)

     [Steve Henson]



 Changes between 1.0.0n and 1.0.0o [15 Oct 2014]

crypto/asn1/a_verify.c

+12 −0
Original line number Diff line number Diff line
@@ -91,6 +91,12 @@ int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *a, ASN1_BIT_STRING *signature, 
		goto err;

		}



	if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)

		{

		ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);

		goto err;

		}

	

	inl=i2d(data,NULL);

	buf_in=OPENSSL_malloc((unsigned int)inl);

	if (buf_in == NULL)
@@ -142,6 +148,12 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a, ASN1_BIT_STRING *signat 
		return -1;

		}



	if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7)

		{

		ASN1err(ASN1_F_ASN1_VERIFY, ASN1_R_INVALID_BIT_STRING_BITS_LEFT);

		return -1;

		}



	EVP_MD_CTX_init(&ctx);



	/* Convert signature OID into digest and public key OIDs */

crypto/dsa/dsa_vrf.c

+13 −1
Original line number Diff line number Diff line
@@ -77,13 +77,25 @@ int DSA_verify(int type, const unsigned char *dgst, int dgst_len, 
	     const unsigned char *sigbuf, int siglen, DSA *dsa)

	{

	DSA_SIG *s;

	const unsigned char *p = sigbuf;

	unsigned char *der = NULL;

	int derlen = -1;

	int ret=-1;



	s = DSA_SIG_new();

	if (s == NULL) return(ret);

	if (d2i_DSA_SIG(&s,&sigbuf,siglen) == NULL) goto err;

	if (d2i_DSA_SIG(&s,&p,siglen) == NULL) goto err;

	/* Ensure signature uses DER and doesn't have trailing garbage */

	derlen = i2d_DSA_SIG(s, &der);

	if (derlen != siglen || memcmp(sigbuf, der, derlen))

		goto err;

	ret=DSA_do_verify(dgst,dgst_len,s,dsa);

err:

	if (derlen > 0)

		{

		OPENSSL_cleanse(der, derlen);

		OPENSSL_free(der);

		}

	DSA_SIG_free(s);

	return(ret);

	}

crypto/ecdsa/ecs_vrf.c

+14 −1
Original line number Diff line number Diff line
@@ -57,6 +57,7 @@ 
 */



#include "ecs_locl.h"

#include "cryptlib.h"

#ifndef OPENSSL_NO_ENGINE

#include <openssl/engine.h>

#endif
@@ -84,13 +85,25 @@ int ECDSA_verify(int type, const unsigned char *dgst, int dgst_len, 
		const unsigned char *sigbuf, int sig_len, EC_KEY *eckey)

 	{

	ECDSA_SIG *s;

	const unsigned char *p = sigbuf;

	unsigned char *der = NULL;

	int derlen = -1;

	int ret=-1;



	s = ECDSA_SIG_new();

	if (s == NULL) return(ret);

	if (d2i_ECDSA_SIG(&s, &sigbuf, sig_len) == NULL) goto err;

	if (d2i_ECDSA_SIG(&s, &p, sig_len) == NULL) goto err;

	/* Ensure signature uses DER and doesn't have trailing garbage */

	derlen = i2d_ECDSA_SIG(s, &der);

	if (derlen != sig_len || memcmp(sigbuf, der, derlen))

		goto err;

	ret=ECDSA_do_verify(dgst, dgst_len, s, eckey);

err:

	if (derlen > 0)

		{

		OPENSSL_cleanse(der, derlen);

		OPENSSL_free(der);

		}

	ECDSA_SIG_free(s);

	return(ret);

	}

crypto/x509/x_all.c

+2 −0
Original line number Diff line number Diff line
@@ -72,6 +72,8 @@ 


int X509_verify(X509 *a, EVP_PKEY *r)

	{

	if (X509_ALGOR_cmp(a->sig_alg, a->cert_info->signature))

		return 0;

	return(ASN1_item_verify(ASN1_ITEM_rptr(X509_CINF),a->sig_alg,

		a->signature,a->cert_info,r));

	}