A limited number of the popular open source OpenSSL cryptographic library is vulnerable to a serious flaw that permits silent, man-in-in-the middle interception attacks.
OpenSSL attempts to find an alternative digital certificate chain should the first attempt to build the verification trail fail.
The flaw, given CVE-2015-1793 moniker, is down to a logic implementation error that allows attackers to bypass some checks such as the Certificate Authority (CA) flag.
This in turn lets attackers use a valid leaf certificate and act as a CA so as to wrongly issue an invalid certificate that the victim system will trust.
OpenSSL rates the flaw as having high severity. It affects any application that verifies certificates, including Secure Sockets Layer/Transport Layer Security clients and servers, during client authentication.
Versions 1.0.1n and 1.0.1.o are vulnerable to the flaw, as well as 1.0.2b and 1.0.2c; OpenSSL users are advised to upgrade to 1.0.1p and 1.0.2d respectively.
Developer Mattias Geniar at web hosting firm Nucleus in Belgium analysed the flaw on his blog, and claimed it was "pretty damn serious indeed".
"This kind of vulnerability allows man-in-the-middle attacks and could cause applications to see invalid and untrusted SSL certificates as valid. It essentially allows everyone to come to their own Certificate Authority (CA)," Geniar wrote.
Geniar noted that as the vulnerability appears to have been introduced in June this year, many Linux distributions are relatively safe as they haven't introduced OpenSSL updates for the last while.
This includes Red Hat, CentOS and Ubuntu, he said. Red Hat confirmed that its products are not vulnerable to the alternative chains certificate forgery vulnerability, as its policy of carefully backporting important bug fixes and selected features meant the code commits with the logic error were not applied to its versions of OpenSSL.
David Benjamin of and Adam Langley of Google's BoringSSL project are credited with finding the vulnerability.
