Commit a91be108 authored by Dr. Stephen Henson's avatar Dr. Stephen Henson
Browse files

Fix for CVE-2014-0224 

Only accept change cipher spec when it is expected instead of at any
time. This prevents premature setting of session keys before the master
secret is determined which an attacker could use as a MITM attack.

Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for reporting this issue
and providing the initial fix this patch is based on.
(cherry picked from commit bc8923b1)
parent a7c682fb

ssl/s3_clnt.c

+2 −0
Original line number Diff line number Diff line
@@ -599,6 +599,7 @@ int ssl3_connect(SSL *s) 
		case SSL3_ST_CR_FINISHED_A:

		case SSL3_ST_CR_FINISHED_B:



			s->s3->flags |= SSL3_FLAGS_CCS_OK;

			ret=ssl3_get_finished(s,SSL3_ST_CR_FINISHED_A,

				SSL3_ST_CR_FINISHED_B);

			if (ret <= 0) goto end;
@@ -1051,6 +1052,7 @@ int ssl3_get_server_hello(SSL *s) 
		SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT);

		goto f_err;

		}

	    s->s3->flags |= SSL3_FLAGS_CCS_OK;

	    s->hit=1;

	    }

	else	/* a miss or crap from the other end */

ssl/s3_pkt.c

+9 −0
Original line number Diff line number Diff line
@@ -1593,6 +1593,15 @@ start: 
			goto f_err;

			}



		if (!(s->s3->flags & SSL3_FLAGS_CCS_OK))

			{

			al=SSL_AD_UNEXPECTED_MESSAGE;

			SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_CCS_RECEIVED_EARLY);

			goto f_err;

			}



		s->s3->flags &= ~SSL3_FLAGS_CCS_OK;



		rr->length=0;



		if (s->msg_callback)

ssl/s3_srvr.c

+5 −0
Original line number Diff line number Diff line
@@ -708,6 +708,7 @@ int ssl3_accept(SSL *s) 
		case SSL3_ST_SR_CERT_VRFY_A:

		case SSL3_ST_SR_CERT_VRFY_B:



			s->s3->flags |= SSL3_FLAGS_CCS_OK;

			/* we should decide if we expected this one */

			ret=ssl3_get_cert_verify(s);

			if (ret <= 0) goto end;
@@ -735,6 +736,7 @@ int ssl3_accept(SSL *s) 


		case SSL3_ST_SR_FINISHED_A:

		case SSL3_ST_SR_FINISHED_B:

			s->s3->flags |= SSL3_FLAGS_CCS_OK;

			ret=ssl3_get_finished(s,SSL3_ST_SR_FINISHED_A,

				SSL3_ST_SR_FINISHED_B);

			if (ret <= 0) goto end;
@@ -805,7 +807,10 @@ int ssl3_accept(SSL *s) 
				s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;

#else

				if (s->s3->next_proto_neg_seen)

					{

					s->s3->flags |= SSL3_FLAGS_CCS_OK;

					s->s3->tmp.next_state=SSL3_ST_SR_NEXT_PROTO_A;

					}

				else

					s->s3->tmp.next_state=SSL3_ST_SR_FINISHED_A;

#endif

ssl/ssl3.h

+1 −0
Original line number Diff line number Diff line
@@ -428,6 +428,7 @@ typedef struct ssl3_buffer_st 
#define TLS1_FLAGS_TLS_PADDING_BUG		0x0008

#define TLS1_FLAGS_SKIP_CERT_VERIFY		0x0010

#define TLS1_FLAGS_KEEP_HANDSHAKE		0x0020

#define SSL3_FLAGS_CCS_OK			0x0080

 

/* SSL3_FLAGS_SGC_RESTART_DONE is set when we

 * restart a handshake because of MS SGC and so prevents us