OpenBSD Journal

y Patches available for Klima-Pokorny-Rosa attack

Contributed by jose on from the not-a-good-week-for-OpenSSL dept.

Shane pointed this out to us:
"Patch 12 for 3.2 and 25 for 3.1 just came out too.

Todd Miller says:

Researchers have discovered an extension of the "Bleichenbacher attack" on RSA with PKCS #1 v1.5 padding. The attack affects TLS 1.0 (aka SSL 3.0) but does *not* affect OpenSSH. Exploitation requires that an attacker open millions of TLS connections to the machine being attacked.

Users who run services utilizing TLS and RSA encryption should update their OpenSSL to the version now in OpenBSD-current and the 3.1 and 3.2 -stable branches or use one of the patches below.

Patch for OpenBSD 3.1: Patch 025
Patch for OpenBSD 3.2: Patch 012

The OpenSSL advisory (from which the patches are derived) is here ."

The report "Attacking RSA-based Sessions in SSL/TLS" by V. Klima, O. Pokorny, and T. Rosa is available now , too. Thanks Shane, and thank you Todd.

(Comments are closed)

Comments

  1. By Anonymous Coward () on

    2 patches for rather 'academic' security holes in one day... those researchers sure have been busy today ;)

    Comments

    1. By Anonymous Coward () on

      they conducted succesful demonstration - so the insecurities vent from academic papers to industry-grade strength

    2. By Anonymous Coward () on

      I know this iss realy off Topic but i cant find the link to comment the Story directly. As a whole bunch of people commenting the storys here, i always comment the first comment of the story, and NOT the Story itself, just as this comment again. Maybe someone can tell me where my red, wracked eyes should scan for a linkt to comment the Story directly. Thank you for any respond to this ... :)

      Comments

      1. By Anonymous Coward () on

        >

      2. By Anonymous Coward () on

        >

      3. By Anonymous Coward () on

        This is funny, i wanted to paste the > and <br> all i got was > <br>

      4. By Anonymous Coward () on

        And it parses html..

      5. By Anonymous Coward () on

        Open the detailed view of the story (with comments), then, above the first comment, there are some links: a link to the previous story, a reply link (this is the one you need), a flattened/threaded link, and optionally a link to the next story (if there is a next story)

  2. By Anonymous Coward () on

    So I downloaded patch 011 and 012. I used head to see what I should do with them. I did those steps. But I can't help but think that there's a step missing. Here are the steps:

    For 011:

    Apply by doing:
    cd /usr/src
    patch -p0 <011_blinding.patch

    And then rebuild and install OpenSSL:
    rm -fr /usr/obj/lib/libssl
    cd lib/libssl
    make obj
    make cleandir
    make depend
    make
    make install

    For 012:

    Apply by doing:
    cd /usr/src
    patch -p0 <012_kpr.patch

    And then rebuild and install OpenSSL:
    rm -fr /usr/obj/lib/libssl
    cd lib/libssl
    make obj
    make cleandir
    make depend
    make
    make install

    So here's what I did:

    Apply by doing:
    cd /usr/src
    patch -p0 <011_blinding.patch
    patch -p0 <012_kpr.patch

    And then rebuild and install OpenSSL:
    rm -fr /usr/obj/lib/libssl
    cd lib/libssl
    make obj
    make cleandir
    make depend
    make
    make install

    But don't I have to make sure that currently running processes that might have been using libssl start using the new code? How do I find out which processes use libssl? Can I just SIGHUP those processess?

    Comments

    1. By Anonymous Coward () on

      ldd `which httpd`

    2. By Anonymous Coward () on

      stop/start affected daemons or reboot if you're not sure what links it in

      Comments

      1. By Anonymous Coward () on

        examine ps aux output
        examine running programs with ldd
        restart as necessary (not kill -1), no need to reboot, as bug does not affect kernel

  3. By Anonymous Coward () on

    What's OpenBSD going to deal with OpenSSL?

    Comments

    1. By Anonymous Coward () on

      It is included in base distribution, not in optional ports

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]