iTnews

'High severity' flaw discovered in OpenSSL

By Juha Saarinen, iTnews on Jul 10, 2015 6:13AM
'High severity' flaw discovered in OpenSSL

Certificate bypass check possible.

A limited number of the popular open source OpenSSL cryptographic library is vulnerable to a serious flaw that permits silent, man-in-in-the middle interception attacks.

OpenSSL attempts to find an alternative digital certificate chain should the first attempt to build the verification trail fail.

The flaw, given CVE-2015-1793 moniker, is down to a logic implementation error that allows attackers to bypass some checks such as the Certificate Authority (CA) flag. 

This in turn lets attackers use a valid leaf certificate and act as a CA so as to wrongly issue an invalid certificate that the victim system will trust.

OpenSSL rates the flaw as having high severity. It affects any application that verifies certificates, including Secure Sockets Layer/Transport Layer Security clients and servers, during client authentication.

Versions 1.0.1n and 1.0.1.o are vulnerable to the flaw, as well as 1.0.2b and 1.0.2c; OpenSSL users are advised to upgrade to 1.0.1p and 1.0.2d respectively.

Developer Mattias Geniar at web hosting firm Nucleus in Belgium analysed the flaw on his blog, and claimed it was "pretty damn serious indeed".

"This kind of vulnerability allows man-in-the-middle attacks and could cause applications to see invalid and untrusted SSL certificates as valid. It essentially allows everyone to come to their own Certificate Authority (CA)," Geniar wrote.

Geniar noted that as the vulnerability appears to have been introduced in June this year, many Linux distributions are relatively safe as they haven't introduced OpenSSL updates for the last while.

This includes Red Hat, CentOS and Ubuntu, he said. Red Hat confirmed that its products are not vulnerable to the alternative chains certificate forgery vulnerability, as its policy of carefully backporting important bug fixes and selected features meant the code commits with the logic error were not applied to its versions of OpenSSL.

David Benjamin of and Adam Langley of Google's BoringSSL project are credited with finding the vulnerability.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:
certificates cryptography cvd20151793 forgery mitm openssl security

Partner Content

Beat the DDoS blackmails in 2021
Partner Content Beat the DDoS blackmails in 2021
Why companies fail at picking cloud modernisation partners
Partner Content Why companies fail at picking cloud modernisation partners
Shut the door on ransomware
Partner Content Shut the door on ransomware
MSI shows first laptops with Wi-Fi 6E, Nvidia RTX 30 graphics
Partner Content MSI shows first laptops with Wi-Fi 6E, Nvidia RTX 30 graphics

Sponsored Whitepapers

The risky business of open source
The risky business of open source
Ensure your e-signatures are legally binding
Ensure your e-signatures are legally binding
Mitigating open source risk in your organisation
Mitigating open source risk in your organisation
How to choose a WAF that's right for you
How to choose a WAF that's right for you
The global telco 5G cloud gaming opportunity
The global telco 5G cloud gaming opportunity

Events

  • On-Demand Webinar: How Poly and Microsoft are Embracing Future Work Environments
  • Beat the DDoS blackmailers in 2021
By Juha Saarinen, iTnews
Jul 10 2015
6:13AM
0 Comments

Related Articles

  • Toshiba targets $4.2bn revenue in quantum cryptography by 2030
  • New Raindrop malware used in SolarWinds hack found
  • Security vendor Malwarebytes hacked through Office 365 and Azure
  • UNSW restarts search for new CISO
Share on Twitter Share on Facebook Share on LinkedIn Share on Whatsapp Email A Friend

Most Read Articles

Telstra blasts plan to 'set aside' mobile spectrum for Optus and TPG, but not it

Telstra blasts plan to 'set aside' mobile spectrum for Optus and TPG, but not it

Google unravels state-of-art Android and Windows exploit chains

Google unravels state-of-art Android and Windows exploit chains

Tyro halts trading following week-long outage

Tyro halts trading following week-long outage

Defence switches on initial SAP ERP system capability

Defence switches on initial SAP ERP system capability

You must be a registered member of iTnews to post a comment.
Log In | Register
All rights reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorisation.
Your use of this website constitutes acceptance of nextmedia's Privacy Policy and Terms & Conditions.