{"id":3732,"date":"2014-06-06T21:00:17","date_gmt":"2014-06-06T13:00:17","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3732"},"modified":"2015-09-09T19:36:49","modified_gmt":"2015-09-09T11:36:49","slug":"important-openssl-patch-6-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2014\/06\/important-openssl-patch-6-vulnerabilities\/","title":{"rendered":"Important OpenSSL Patch – 6 More Vulnerabilities"},"content":{"rendered":"

So after the Heartbleed<\/a> vulnerability in OpenSSL that turned the World upside down, there has a been a lot of focus on the codebase and the manner in which it was written. They’ve raised a bunch of money, an audit is underway<\/a> and there has even been a fairly serious branch named LibreSSL<\/a> (who are currently whining about not being told about this set of vulns).<\/p>\n

\"OpenSSL<\/p>\n

So yah if you have any Linux servers terminating SSL connections with OpenSSL (or LibreSSL) you really need to patch them now and reload any services using the library (or safer just to reboot if you’re not sure).<\/p>\n

The good part this time is none of these are particularly easy to exploit, unlike Heartbleed – which could pretty much be abused by anyone.<\/p>\n

The OpenSSL team today pushed out fixes for six security vulnerabilities in the widely used crypto library.<\/p>\n

These holes include a flaw that enables man-in-the-middle (MITM) eavesdropping on encrypted connections, and another that allows miscreants to drop malware on at-risk systems.<\/p>\n

A DTLS invalid fragment bug (CVE-2014-0195, affects versions 0.9.8, 1.0.0 and 1.0.1) can be used to inject malicious code into vulnerable software on apps or servers. DTLS is more or less TLS encryption over UDP rather than TCP, and is used to secure live streams of video, voice chat and so on.<\/p>\n

However, an SSL\/TLS MITM vulnerability (CVE-2014-0224, potentially affects all clients, and servers running 1.0.1 and 1.0.2-beta1) is arguably worse.<\/p>\n

Users and administrators are advised to check their systems for updates; patched builds of OpenSSL are available from the major Linux distros, for instance.
\nEarly CCS MITM logo, source: http:\/\/ccsinjection.lepidum.co.jp<\/p>\n

The CVE-2014-0224 MITM bug has existed since the very first release of OpenSSL, according to Masashi Kikuchi, the Japanese security researcher who unearthed the flaw.<\/p><\/blockquote>\n