OpenSSL Security Advisory [30 July 2002] (bca9dc2a) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP OpenSSL

CHANGES

+42 −1

Original line number	Original line	Diff line number	Diff line
	@@ -1667,7 +1667,13 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
	*) Clean old EAY MD5 hack from e_os.h.		*) Clean old EAY MD5 hack from e_os.h.
	[Richard Levitte]		[Richard Levitte]

	Changes between 0.9.6d and 0.9.6e [XX xxx XXXX]		Changes between 0.9.6d and 0.9.6e [30 Jul 2002]

			*) Add various sanity checks to asn1_get_length() to reject
			the ASN1 length bytes if they exceed sizeof(long), will appear
			negative or the content length exceeds the length of the
			supplied buffer.
			[Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]

	*) Fix cipher selection routines: ciphers without encryption had no flags		*) Fix cipher selection routines: ciphers without encryption had no flags
	for the cipher strength set and where therefore not handled correctly		for the cipher strength set and where therefore not handled correctly
	@@ -1690,6 +1696,41 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
	applications.		applications.
	[Bodo Moeller]		[Bodo Moeller]

			*) Changes in security patch:

			Changes marked "(CHATS)" were sponsored by the Defense Advanced
			Research Projects Agency (DARPA) and Air Force Research Laboratory,
			Air Force Materiel Command, USAF, under agreement number
			F30602-01-2-0537.

			*) Add various sanity checks to asn1_get_length() to reject
			the ASN1 length bytes if they exceed sizeof(long), will appear
			negative or the content length exceeds the length of the
			supplied buffer. (CAN-2002-0659)
			[Steve Henson, Adi Stav <stav@mercury.co.il>, James Yonan <jim@ntlp.com>]

			*) Assertions for various potential buffer overflows, not known to
			happen in practice.
			[Ben Laurie (CHATS)]

			*) Various temporary buffers to hold ASCII versions of integers were
			too small for 64 bit platforms. (CAN-2002-0655)
			[Matthew Byng-Maddick <mbm@aldigital.co.uk> and Ben Laurie (CHATS)>

			*) Remote buffer overflow in SSL3 protocol - an attacker could
			supply an oversized master key in Kerberos-enabled versions.
			(CAN-2002-0657)
			[Ben Laurie (CHATS)]

			*) Remote buffer overflow in SSL3 protocol - an attacker could
			supply an oversized session ID to a client. (CAN-2002-0656)
			[Ben Laurie (CHATS)]

			*) Remote buffer overflow in SSL2 protocol - an attacker could
			supply an oversized client master key. (CAN-2002-0656)
			[Ben Laurie (CHATS)]


	Changes between 0.9.6c and 0.9.6d [9 May 2002]		Changes between 0.9.6c and 0.9.6d [9 May 2002]

	*) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not		*) Fix crypto/asn1/a_sign.c so that 'parameters' is omitted (not

crypto/asn1/asn1_lib.c

+6 −4

Original line number	Original line	Diff line number	Diff line
	@@ -124,15 +124,13 @@ int ASN1_get_object(unsigned char *pp, long plength, int ptag, int pclass,
	(int)(omax+ *pp));		(int)(omax+ *pp));

	#endif		#endif
	#if 0		if (plength > (omax - (pp - p)))
	if ((p+ plength) > (omax+ pp))
	{		{
	ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);		ASN1err(ASN1_F_ASN1_GET_OBJECT,ASN1_R_TOO_LONG);
	/* Set this so that even if things are not long enough		/* Set this so that even if things are not long enough
	* the values are set correctly */		* the values are set correctly */
	ret\|=0x80;		ret\|=0x80;
	}		}
	#endif
	*pp=p;		*pp=p;
	return(ret\|inf);		return(ret\|inf);
	err:		err:
	@@ -159,6 +157,8 @@ static int asn1_get_length(unsigned char *pp, int inf, long *rl, int max)
	i= *p&0x7f;		i= *p&0x7f;
	if (*(p++) & 0x80)		if (*(p++) & 0x80)
	{		{
			if (i > sizeof(long))
			return 0;
	if (max-- == 0) return(0);		if (max-- == 0) return(0);
	while (i-- > 0)		while (i-- > 0)
	{		{
	@@ -170,6 +170,8 @@ static int asn1_get_length(unsigned char *pp, int inf, long *rl, int max)
	else		else
	ret=i;		ret=i;
	}		}
			if (ret < 0)
			return 0;
	*pp=p;		*pp=p;
	*rl=ret;		*rl=ret;
	return(1);		return(1);
	@@ -407,7 +409,7 @@ int ASN1_STRING_cmp(ASN1_STRING a, ASN1_STRING b)

	void asn1_add_error(unsigned char *address, int offset)		void asn1_add_error(unsigned char *address, int offset)
	{		{
	char buf1[16],buf2[16];		char buf1[DECIMAL_SIZE(address)+1],buf2[DECIMAL_SIZE(offset)+1];

	sprintf(buf1,"%lu",(unsigned long)address);		sprintf(buf1,"%lu",(unsigned long)address);
	sprintf(buf2,"%d",offset);		sprintf(buf2,"%d",offset);

crypto/conf/Makefile.ssl

+6 −6

Original line number	Original line	Diff line number	Diff line
	@@ -89,14 +89,14 @@ conf_api.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
	conf_api.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h		conf_api.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
	conf_api.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h		conf_api.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
	conf_api.o: conf_api.c		conf_api.o: conf_api.c
	conf_def.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h		conf_def.o: ../../e_os.h ../../include/openssl/bio.h
	conf_def.o: ../../include/openssl/conf.h ../../include/openssl/conf_api.h		conf_def.o: ../../include/openssl/buffer.h ../../include/openssl/conf.h
	conf_def.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h		conf_def.o: ../../include/openssl/conf_api.h ../../include/openssl/crypto.h
	conf_def.o: ../../include/openssl/err.h ../../include/openssl/lhash.h		conf_def.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
	conf_def.o: ../../include/openssl/opensslconf.h		conf_def.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
	conf_def.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h		conf_def.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
	conf_def.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h		conf_def.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
	conf_def.o: conf_def.c conf_def.h		conf_def.o: ../cryptlib.h conf_def.c conf_def.h
	conf_err.o: ../../include/openssl/bio.h ../../include/openssl/conf.h		conf_err.o: ../../include/openssl/bio.h ../../include/openssl/conf.h
	conf_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h		conf_err.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
	conf_err.o: ../../include/openssl/err.h ../../include/openssl/lhash.h		conf_err.o: ../../include/openssl/err.h ../../include/openssl/lhash.h

crypto/conf/conf_def.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -67,6 +67,7 @@
	#include "conf_def.h"		#include "conf_def.h"
	#include <openssl/buffer.h>		#include <openssl/buffer.h>
	#include <openssl/err.h>		#include <openssl/err.h>
			#include "cryptlib.h"

	static char eat_ws(CONF conf, char *p);		static char eat_ws(CONF conf, char *p);
	static char eat_alpha_numeric(CONF conf, char *p);		static char eat_alpha_numeric(CONF conf, char *p);
	@@ -208,12 +209,12 @@ static int def_load(CONF conf, const char name, long *line)
	static int def_load_bio(CONF conf, BIO in, long *line)		static int def_load_bio(CONF conf, BIO in, long *line)
	{		{
	#define BUFSIZE 512		#define BUFSIZE 512
	char btmp[16];
	int bufnum=0,i,ii;		int bufnum=0,i,ii;
	BUF_MEM *buff=NULL;		BUF_MEM *buff=NULL;
	char s,p,*end;		char s,p,*end;
	int again,n;		int again,n;
	long eline=0;		long eline=0;
			char btmp[DECIMAL_SIZE(eline)+1];
	CONF_VALUE v=NULL,tv;		CONF_VALUE v=NULL,tv;
	CONF_VALUE *sv=NULL;		CONF_VALUE *sv=NULL;
	char section=NULL,buf;		char section=NULL,buf;

crypto/conf/conf_mod.c

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -230,7 +230,7 @@ static int module_run(const CONF cnf, char name, char *value,
	{		{
	if (!(flags & CONF_MFLAGS_SILENT))		if (!(flags & CONF_MFLAGS_SILENT))
	{		{
	char rcode[10];		char rcode[DECIMAL_SIZE(ret)+1];
	CONFerr(CONF_F_CONF_MODULES_LOAD, CONF_R_MODULE_INITIALIZATION_ERROR);		CONFerr(CONF_F_CONF_MODULES_LOAD, CONF_R_MODULE_INITIALIZATION_ERROR);
	sprintf(rcode, "%-8d", ret);		sprintf(rcode, "%-8d", ret);
	ERR_add_error_data(6, "module=", name, ", value=", value, ", retcode=", rcode);		ERR_add_error_data(6, "module=", name, ", value=", value, ", retcode=", rcode);

Admin message