[Pkg-openssl-changes] r690 - in openssl/branches/wheezy/debian: . patches
Kurt Roeckx
kroeckx at moszumanska.debian.org
Mon Aug 11 19:37:26 UTC 2014
Author: kroeckx
Date: 2014-08-11 19:37:26 +0000 (Mon, 11 Aug 2014)
New Revision: 690
Added:
openssl/branches/wheezy/debian/patches/Added-comment-for-the-frag-reassembly-NULL-case-as-p.patch
openssl/branches/wheezy/debian/patches/Applying-same-fix-as-in-dtls1_process_out_of_seq_mes.patch
openssl/branches/wheezy/debian/patches/Avoid-double-free-when-processing-DTLS-packets.patch
openssl/branches/wheezy/debian/patches/Check-SRP-parameters-early.patch
openssl/branches/wheezy/debian/patches/Fix-DTLS-anonymous-EC-DH-denial-of-service.patch
openssl/branches/wheezy/debian/patches/Fix-DTLS-handshake-message-size-checks.patch
openssl/branches/wheezy/debian/patches/Fix-OID-handling.patch
openssl/branches/wheezy/debian/patches/Fix-SRP-buffer-overrun-vulnerability.patch
openssl/branches/wheezy/debian/patches/Fix-SRP-ciphersuite-DoS-vulnerability.patch
openssl/branches/wheezy/debian/patches/Fix-memory-leak-from-zero-length-DTLS-fragments.patch
openssl/branches/wheezy/debian/patches/Fix-protocol-downgrade-bug-in-case-of-fragmented-pac.patch
openssl/branches/wheezy/debian/patches/Fix-race-condition-in-ssl_parse_serverhello_tlsext.patch
openssl/branches/wheezy/debian/patches/Fix-return-code-for-truncated-DTLS-fragment.patch
openssl/branches/wheezy/debian/patches/Remove-some-duplicate-DTLS-code.patch
openssl/branches/wheezy/debian/patches/SRP-ciphersuite-correction.patch
Modified:
openssl/branches/wheezy/debian/changelog
openssl/branches/wheezy/debian/patches/series
Log:
Fix CVE-2014-3512
Fix CVE-2014-3511
Fix CVE-2014-3510
Fix CVE-2014-3507
Fix CVE-2014-3506
Fix CVE-2014-3505
Fix CVE-2014-3509
Fix CVE-2014-5139
Fix CVE-2014-3508
Modified: openssl/branches/wheezy/debian/changelog
===================================================================
--- openssl/branches/wheezy/debian/changelog 2014-08-11 19:36:05 UTC (rev 689)
+++ openssl/branches/wheezy/debian/changelog 2014-08-11 19:37:26 UTC (rev 690)
@@ -1,3 +1,17 @@
+openssl (1.0.1e-2+deb7u12) wheezy-security; urgency=medium
+
+ * Fix for CVE-2014-3512
+ * Fix for CVE-2014-3511
+ * Fix for CVE-2014-3510
+ * Fix for CVE-2014-3507
+ * Fix for CVE-2014-3506
+ * Fix for CVE-2014-3505
+ * Fix for CVE-2014-3509
+ * Fix for CVE-2014-5139
+ * Fix for CVE-2014-3508
+
+ -- Kurt Roeckx <kurt at roeckx.be> Wed, 06 Aug 2014 20:01:34 +0200
+
openssl (1.0.1e-2+deb7u11) wheezy-security; urgency=medium
* Update fix for CVE-2014-0224 to work with more renegiotation and
Added: openssl/branches/wheezy/debian/patches/Added-comment-for-the-frag-reassembly-NULL-case-as-p.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Added-comment-for-the-frag-reassembly-NULL-case-as-p.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Added-comment-for-the-frag-reassembly-NULL-case-as-p.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,31 @@
+From 5788f66455b533a734df3b3f816f79be2a44da32 Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt at openssl.org>
+Date: Thu, 24 Jul 2014 23:33:34 +0100
+Subject: [PATCH 02/16] Added comment for the frag->reassembly == NULL case as
+ per feedback from Emilia
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+---
+ ssl/d1_both.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
+index cdb83b6..6559dfc 100644
+--- a/ssl/d1_both.c
++++ b/ssl/d1_both.c
+@@ -639,7 +639,8 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+
+
+ /* If message is already reassembled, this must be a
+- * retransmit and can be dropped.
++ * retransmit and can be dropped. In this case item != NULL and so frag
++ * does not need to be freed.
+ */
+ if (frag->reassembly == NULL)
+ {
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Applying-same-fix-as-in-dtls1_process_out_of_seq_mes.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Applying-same-fix-as-in-dtls1_process_out_of_seq_mes.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Applying-same-fix-as-in-dtls1_process_out_of_seq_mes.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,36 @@
+From cbcb11f5cd46024ff0f1136572d978dc4f50144a Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt at openssl.org>
+Date: Thu, 24 Jul 2014 23:54:28 +0100
+Subject: [PATCH 06/16] Applying same fix as in
+ dtls1_process_out_of_seq_message. A truncated DTLS fragment would cause *ok
+ to be clear, but the return value would still be the number of bytes read.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem identified by Emilia Käsper, based on previous issue/patch by Adam
+Langley.
+
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+---
+ ssl/d1_both.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
+index ac0fcaa..ea8f340 100644
+--- a/ssl/d1_both.c
++++ b/ssl/d1_both.c
+@@ -663,7 +663,9 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ /* read the body of the fragment (header has already been read */
+ i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+ frag->fragment + msg_hdr->frag_off,frag_len,0);
+- if (i<=0 || (unsigned long)i!=frag_len)
++ if ((unsigned long)i!=frag_len)
++ i=-1;
++ if (i<=0)
+ goto err;
+
+ RSMBLY_BITMASK_MARK(frag->reassembly, (long)msg_hdr->frag_off,
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Avoid-double-free-when-processing-DTLS-packets.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Avoid-double-free-when-processing-DTLS-packets.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Avoid-double-free-when-processing-DTLS-packets.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,52 @@
+From 897c36077a1b6e8b78852ed23a6f4bcc92155753 Mon Sep 17 00:00:00 2001
+From: Adam Langley <agl at imperialviolet.org>
+Date: Fri, 6 Jun 2014 14:19:21 -0700
+Subject: [PATCH 01/16] Avoid double free when processing DTLS packets.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The |item| variable, in both of these cases, may contain a pointer to a
+|pitem| structure within |s->d1->buffered_messages|. It was being freed
+in the error case while still being in |buffered_messages|. When the
+error later caused the |SSL*| to be destroyed, the item would be double
+freed.
+
+Thanks to Wah-Teh Chang for spotting that the fix in 1632ef74 was
+inconsistent with the other error paths (but correct).
+
+Fixes CVE-2014-3505
+
+Reviewed-by: Matt Caswell <matt at openssl.org>
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+---
+ ssl/d1_both.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
+index c1eb970..cdb83b6 100644
+--- a/ssl/d1_both.c
++++ b/ssl/d1_both.c
+@@ -693,8 +693,7 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ return DTLS1_HM_FRAGMENT_RETRY;
+
+ err:
+- if (frag != NULL) dtls1_hm_fragment_free(frag);
+- if (item != NULL) OPENSSL_free(item);
++ if (frag != NULL && item == NULL) dtls1_hm_fragment_free(frag);
+ *ok = 0;
+ return i;
+ }
+@@ -778,8 +777,7 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ return DTLS1_HM_FRAGMENT_RETRY;
+
+ err:
+- if ( frag != NULL) dtls1_hm_fragment_free(frag);
+- if ( item != NULL) OPENSSL_free(item);
++ if (frag != NULL && item == NULL) dtls1_hm_fragment_free(frag);
+ *ok = 0;
+ return i;
+ }
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Check-SRP-parameters-early.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Check-SRP-parameters-early.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Check-SRP-parameters-early.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,156 @@
+From d9da3ec088a3442fc2d73cb5a8d95c2edd105bc4 Mon Sep 17 00:00:00 2001
+From: "Dr. Stephen Henson" <steve at openssl.org>
+Date: Fri, 1 Aug 2014 14:56:56 +0100
+Subject: [PATCH 14/16] Check SRP parameters early.
+
+Check SRP parameters when they are received so we can send back an
+appropriate alert.
+Reviewed-by: Kurt Roeckx <kurt at openssl.org>
+---
+ ssl/s3_clnt.c | 6 ++++++
+ ssl/s3_srvr.c | 7 +++++++
+ ssl/ssl.h | 1 +
+ ssl/ssl_err.c | 1 +
+ ssl/ssl_locl.h | 3 +++
+ ssl/tls_srp.c | 48 +++++++++++++++++++++++++++++++++++++-----------
+ 6 files changed, 55 insertions(+), 11 deletions(-)
+
+Index: openssl-1.0.1e/ssl/s3_clnt.c
+===================================================================
+--- openssl-1.0.1e.orig/ssl/s3_clnt.c 2014-08-06 18:43:44.000000000 +0000
++++ openssl-1.0.1e/ssl/s3_clnt.c 2014-08-06 18:43:56.805003347 +0000
+@@ -1470,6 +1470,12 @@
+ p+=i;
+ n-=param_len;
+
++ if (!srp_verify_server_param(s, &al))
++ {
++ SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE,SSL_R_BAD_SRP_PARAMETERS);
++ goto f_err;
++ }
++
+ /* We must check if there is a certificate */
+ #ifndef OPENSSL_NO_RSA
+ if (alg_a & SSL_aRSA)
+Index: openssl-1.0.1e/ssl/s3_srvr.c
+===================================================================
+--- openssl-1.0.1e.orig/ssl/s3_srvr.c 2014-08-06 18:41:01.000000000 +0000
++++ openssl-1.0.1e/ssl/s3_srvr.c 2014-08-06 18:43:56.889001598 +0000
+@@ -2799,6 +2799,13 @@
+ SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,ERR_R_BN_LIB);
+ goto err;
+ }
++ if (BN_ucmp(s->srp_ctx.A, s->srp_ctx.N) >= 0
++ || BN_is_zero(s->srp_ctx.A))
++ {
++ al=SSL_AD_ILLEGAL_PARAMETER;
++ SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,SSL_R_BAD_SRP_PARAMETERS);
++ goto f_err;
++ }
+ if (s->session->srp_username != NULL)
+ OPENSSL_free(s->session->srp_username);
+ s->session->srp_username = BUF_strdup(s->srp_ctx.login);
+Index: openssl-1.0.1e/ssl/ssl.h
+===================================================================
+--- openssl-1.0.1e.orig/ssl/ssl.h 2014-08-06 18:43:44.000000000 +0000
++++ openssl-1.0.1e/ssl/ssl.h 2014-08-06 18:43:56.893001514 +0000
+@@ -2313,6 +2313,7 @@
+ #define SSL_R_BAD_SRP_B_LENGTH 348
+ #define SSL_R_BAD_SRP_G_LENGTH 349
+ #define SSL_R_BAD_SRP_N_LENGTH 350
++#define SSL_R_BAD_SRP_PARAMETERS 371
+ #define SSL_R_BAD_SRP_S_LENGTH 351
+ #define SSL_R_BAD_SRTP_MKI_VALUE 352
+ #define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST 353
+Index: openssl-1.0.1e/ssl/ssl_err.c
+===================================================================
+--- openssl-1.0.1e.orig/ssl/ssl_err.c 2013-02-11 15:26:04.000000000 +0000
++++ openssl-1.0.1e/ssl/ssl_err.c 2014-08-06 18:43:56.893001514 +0000
+@@ -329,6 +329,7 @@
+ {ERR_REASON(SSL_R_BAD_SRP_B_LENGTH) ,"bad srp b length"},
+ {ERR_REASON(SSL_R_BAD_SRP_G_LENGTH) ,"bad srp g length"},
+ {ERR_REASON(SSL_R_BAD_SRP_N_LENGTH) ,"bad srp n length"},
++{ERR_REASON(SSL_R_BAD_SRP_PARAMETERS) ,"bad srp parameters"},
+ {ERR_REASON(SSL_R_BAD_SRP_S_LENGTH) ,"bad srp s length"},
+ {ERR_REASON(SSL_R_BAD_SRTP_MKI_VALUE) ,"bad srtp mki value"},
+ {ERR_REASON(SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST),"bad srtp protection profile list"},
+Index: openssl-1.0.1e/ssl/ssl_locl.h
+===================================================================
+--- openssl-1.0.1e.orig/ssl/ssl_locl.h 2014-08-06 18:43:44.000000000 +0000
++++ openssl-1.0.1e/ssl/ssl_locl.h 2014-08-06 18:44:41.368075207 +0000
+@@ -1174,4 +1174,6 @@
+ const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx,
+ const unsigned char *data, size_t data_len, size_t orig_len);
+
++int srp_verify_server_param(SSL *s, int *al);
++
+ #endif
+Index: openssl-1.0.1e/ssl/tls_srp.c
+===================================================================
+--- openssl-1.0.1e.orig/ssl/tls_srp.c 2013-02-11 15:26:04.000000000 +0000
++++ openssl-1.0.1e/ssl/tls_srp.c 2014-08-06 18:43:56.893001514 +0000
+@@ -408,16 +408,46 @@
+ return ret;
+ }
+
+-int SRP_Calc_A_param(SSL *s)
++int srp_verify_server_param(SSL *s, int *al)
+ {
+- unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
++ SRP_CTX *srp = &s->srp_ctx;
++ /* Sanity check parameters: we can quickly check B % N == 0
++ * by checking B != 0 since B < N
++ */
++ if (BN_ucmp(srp->g, srp->N) >=0 || BN_ucmp(srp->B, srp->N) >= 0
++ || BN_is_zero(srp->B))
++ {
++ *al = SSL3_AD_ILLEGAL_PARAMETER;
++ return 0;
++ }
++
++ if (BN_num_bits(srp->N) < srp->strength)
++ {
++ *al = TLS1_AD_INSUFFICIENT_SECURITY;
++ return 0;
++ }
++
++ if (srp->SRP_verify_param_callback)
++ {
++ if (srp->SRP_verify_param_callback(s, srp->SRP_cb_arg) <= 0)
++ {
++ *al = TLS1_AD_INSUFFICIENT_SECURITY;
++ return 0;
++ }
++ }
++ else if(!SRP_check_known_gN_param(srp->g, srp->N))
++ {
++ *al = TLS1_AD_INSUFFICIENT_SECURITY;
++ return 0;
++ }
+
+- if (BN_num_bits(s->srp_ctx.N) < s->srp_ctx.strength)
+- return -1;
++ return 1;
++ }
++
+
+- if (s->srp_ctx.SRP_verify_param_callback ==NULL &&
+- !SRP_check_known_gN_param(s->srp_ctx.g,s->srp_ctx.N))
+- return -1 ;
++int SRP_Calc_A_param(SSL *s)
++ {
++ unsigned char rnd[SSL_MAX_MASTER_KEY_LENGTH];
+
+ RAND_bytes(rnd, sizeof(rnd));
+ s->srp_ctx.a = BN_bin2bn(rnd, sizeof(rnd), s->srp_ctx.a);
+@@ -426,10 +456,6 @@
+ if (!(s->srp_ctx.A = SRP_Calc_A(s->srp_ctx.a,s->srp_ctx.N,s->srp_ctx.g)))
+ return -1;
+
+- /* We can have a callback to verify SRP param!! */
+- if (s->srp_ctx.SRP_verify_param_callback !=NULL)
+- return s->srp_ctx.SRP_verify_param_callback(s,s->srp_ctx.SRP_cb_arg);
+-
+ return 1;
+ }
+
Added: openssl/branches/wheezy/debian/patches/Fix-DTLS-anonymous-EC-DH-denial-of-service.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-DTLS-anonymous-EC-DH-denial-of-service.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-DTLS-anonymous-EC-DH-denial-of-service.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,86 @@
+From 1937c518574d81dcdc46c5c2e26541668db19c3e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Emilia=20K=C3=A4sper?= <emilia at openssl.org>
+Date: Thu, 24 Jul 2014 22:15:29 +0200
+Subject: [PATCH 09/16] Fix DTLS anonymous EC(DH) denial of service
+
+CVE-2014-3510
+
+Reviewed-by: Dr. Stephen Henson <steve at openssl.org>
+---
+ ssl/d1_clnt.c | 23 +++++++++++++++++++++--
+ ssl/s3_clnt.c | 7 +++++++
+ 2 files changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/ssl/d1_clnt.c b/ssl/d1_clnt.c
+index 65dbb4a..fd6562c 100644
+--- a/ssl/d1_clnt.c
++++ b/ssl/d1_clnt.c
+@@ -996,6 +996,13 @@ int dtls1_send_client_key_exchange(SSL *s)
+ RSA *rsa;
+ unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
+
++ if (s->session->sess_cert == NULL)
++ {
++ /* We should always have a server certificate with SSL_kRSA. */
++ SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
++ goto err;
++ }
++
+ if (s->session->sess_cert->peer_rsa_tmp != NULL)
+ rsa=s->session->sess_cert->peer_rsa_tmp;
+ else
+@@ -1186,6 +1193,13 @@ int dtls1_send_client_key_exchange(SSL *s)
+ {
+ DH *dh_srvr,*dh_clnt;
+
++ if (s->session->sess_cert == NULL)
++ {
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
++ SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
++ goto err;
++ }
++
+ if (s->session->sess_cert->peer_dh_tmp != NULL)
+ dh_srvr=s->session->sess_cert->peer_dh_tmp;
+ else
+@@ -1245,6 +1259,13 @@ int dtls1_send_client_key_exchange(SSL *s)
+ int ecdh_clnt_cert = 0;
+ int field_size = 0;
+
++ if (s->session->sess_cert == NULL)
++ {
++ ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
++ SSLerr(SSL_F_DTLS1_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
++ goto err;
++ }
++
+ /* Did we send out the client's
+ * ECDH share for use in premaster
+ * computation as part of client certificate?
+@@ -1720,5 +1741,3 @@ int dtls1_send_client_certificate(SSL *s)
+ /* SSL3_ST_CW_CERT_D */
+ return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
+ }
+-
+-
+diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
+index 2afb892..df05f78 100644
+--- a/ssl/s3_clnt.c
++++ b/ssl/s3_clnt.c
+@@ -2253,6 +2253,13 @@ int ssl3_send_client_key_exchange(SSL *s)
+ RSA *rsa;
+ unsigned char tmp_buf[SSL_MAX_MASTER_KEY_LENGTH];
+
++ if (s->session->sess_cert == NULL)
++ {
++ /* We should always have a server certificate with SSL_kRSA. */
++ SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,ERR_R_INTERNAL_ERROR);
++ goto err;
++ }
++
+ if (s->session->sess_cert->peer_rsa_tmp != NULL)
+ rsa=s->session->sess_cert->peer_rsa_tmp;
+ else
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Fix-DTLS-handshake-message-size-checks.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-DTLS-handshake-message-size-checks.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-DTLS-handshake-message-size-checks.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,87 @@
+From 211122a40e13a2dcd17bc61ea18fd68518179991 Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt at openssl.org>
+Date: Fri, 6 Jun 2014 14:25:52 -0700
+Subject: [PATCH 03/16] Fix DTLS handshake message size checks.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In |dtls1_reassemble_fragment|, the value of
+|msg_hdr->frag_off+frag_len| was being checked against the maximum
+handshake message size, but then |msg_len| bytes were allocated for the
+fragment buffer. This means that so long as the fragment was within the
+allowed size, the pending handshake message could consume 16MB + 2MB
+(for the reassembly bitmap). Approx 10 outstanding handshake messages
+are allowed, meaning that an attacker could consume ~180MB per DTLS
+connection.
+
+In the non-fragmented path (in |dtls1_process_out_of_seq_message|), no
+check was applied.
+
+Fixes CVE-2014-3506
+
+Wholly based on patch by Adam Langley with one minor amendment.
+
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+---
+ ssl/d1_both.c | 29 ++++++++++++++++-------------
+ 1 file changed, 16 insertions(+), 13 deletions(-)
+
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
+index 6559dfc..b9e15df 100644
+--- a/ssl/d1_both.c
++++ b/ssl/d1_both.c
+@@ -587,6 +587,16 @@ dtls1_retrieve_buffered_fragment(SSL *s, long max, int *ok)
+ return 0;
+ }
+
++/* dtls1_max_handshake_message_len returns the maximum number of bytes
++ * permitted in a DTLS handshake message for |s|. The minimum is 16KB, but may
++ * be greater if the maximum certificate list size requires it. */
++static unsigned long dtls1_max_handshake_message_len(const SSL *s)
++ {
++ unsigned long max_len = DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
++ if (max_len < (unsigned long)s->max_cert_list)
++ return s->max_cert_list;
++ return max_len;
++ }
+
+ static int
+ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+@@ -595,20 +605,10 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ pitem *item = NULL;
+ int i = -1, is_complete;
+ unsigned char seq64be[8];
+- unsigned long frag_len = msg_hdr->frag_len, max_len;
+-
+- if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
+- goto err;
+-
+- /* Determine maximum allowed message size. Depends on (user set)
+- * maximum certificate length, but 16k is minimum.
+- */
+- if (DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH < s->max_cert_list)
+- max_len = s->max_cert_list;
+- else
+- max_len = DTLS1_HM_HEADER_LENGTH + SSL3_RT_MAX_ENCRYPTED_LENGTH;
++ unsigned long frag_len = msg_hdr->frag_len;
+
+- if ((msg_hdr->frag_off+frag_len) > max_len)
++ if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len ||
++ msg_hdr->msg_len > dtls1_max_handshake_message_len(s))
+ goto err;
+
+ /* Try to find item in queue */
+@@ -749,6 +749,9 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ if (frag_len && frag_len < msg_hdr->msg_len)
+ return dtls1_reassemble_fragment(s, msg_hdr, ok);
+
++ if (frag_len > dtls1_max_handshake_message_len(s))
++ goto err;
++
+ frag = dtls1_hm_fragment_new(frag_len, 0);
+ if ( frag == NULL)
+ goto err;
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Fix-OID-handling.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-OID-handling.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-OID-handling.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,138 @@
+From ef1991a1e3aab245fc35fd7a7076876182fc1fa6 Mon Sep 17 00:00:00 2001
+From: Emilia Kasper <emilia at openssl.org>
+Date: Wed, 2 Jul 2014 19:02:33 +0200
+Subject: [PATCH 10/16] Fix OID handling:
+
+- Upon parsing, reject OIDs with invalid base-128 encoding.
+- Always NUL-terminate the destination buffer in OBJ_obj2txt printing function.
+
+CVE-2014-3508
+
+Reviewed-by: Dr. Stephen Henson <steve at openssl.org>
+Reviewed-by: Kurt Roeckx <kurt at openssl.org>
+Reviewed-by: Tim Hudson <tjh at openssl.org>
+---
+ crypto/asn1/a_object.c | 30 +++++++++++++++++++++---------
+ crypto/objects/obj_dat.c | 16 +++++++++-------
+ 2 files changed, 30 insertions(+), 16 deletions(-)
+
+diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
+index 3978c91..77b2768 100644
+--- a/crypto/asn1/a_object.c
++++ b/crypto/asn1/a_object.c
+@@ -283,17 +283,29 @@ err:
+ ASN1err(ASN1_F_D2I_ASN1_OBJECT,i);
+ return(NULL);
+ }
++
+ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
+ long len)
+ {
+ ASN1_OBJECT *ret=NULL;
+ const unsigned char *p;
+ unsigned char *data;
+- int i;
+- /* Sanity check OID encoding: can't have leading 0x80 in
+- * subidentifiers, see: X.690 8.19.2
++ int i, length;
++
++ /* Sanity check OID encoding.
++ * Need at least one content octet.
++ * MSB must be clear in the last octet.
++ * can't have leading 0x80 in subidentifiers, see: X.690 8.19.2
+ */
+- for (i = 0, p = *pp; i < len; i++, p++)
++ if (len <= 0 || len > INT_MAX || pp == NULL || (p = *pp) == NULL ||
++ p[len - 1] & 0x80)
++ {
++ ASN1err(ASN1_F_C2I_ASN1_OBJECT,ASN1_R_INVALID_OBJECT_ENCODING);
++ return NULL;
++ }
++ /* Now 0 < len <= INT_MAX, so the cast is safe. */
++ length = (int)len;
++ for (i = 0; i < length; i++, p++)
+ {
+ if (*p == 0x80 && (!i || !(p[-1] & 0x80)))
+ {
+@@ -316,23 +328,23 @@ ASN1_OBJECT *c2i_ASN1_OBJECT(ASN1_OBJECT **a, const unsigned char **pp,
+ data = (unsigned char *)ret->data;
+ ret->data = NULL;
+ /* once detached we can change it */
+- if ((data == NULL) || (ret->length < len))
++ if ((data == NULL) || (ret->length < length))
+ {
+ ret->length=0;
+ if (data != NULL) OPENSSL_free(data);
+- data=(unsigned char *)OPENSSL_malloc(len ? (int)len : 1);
++ data=(unsigned char *)OPENSSL_malloc(length);
+ if (data == NULL)
+ { i=ERR_R_MALLOC_FAILURE; goto err; }
+ ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
+ }
+- memcpy(data,p,(int)len);
++ memcpy(data,p,length);
+ /* reattach data to object, after which it remains const */
+ ret->data =data;
+- ret->length=(int)len;
++ ret->length=length;
+ ret->sn=NULL;
+ ret->ln=NULL;
+ /* ret->flags=ASN1_OBJECT_FLAG_DYNAMIC; we know it is dynamic */
+- p+=len;
++ p+=length;
+
+ if (a != NULL) (*a)=ret;
+ *pp=p;
+diff --git a/crypto/objects/obj_dat.c b/crypto/objects/obj_dat.c
+index 8a342ba..0b2f442 100644
+--- a/crypto/objects/obj_dat.c
++++ b/crypto/objects/obj_dat.c
+@@ -471,11 +471,12 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
+ const unsigned char *p;
+ char tbuf[DECIMAL_SIZE(i)+DECIMAL_SIZE(l)+2];
+
+- if ((a == NULL) || (a->data == NULL)) {
+- buf[0]='\0';
+- return(0);
+- }
++ /* Ensure that, at every state, |buf| is NUL-terminated. */
++ if (buf && buf_len > 0)
++ buf[0] = '\0';
+
++ if ((a == NULL) || (a->data == NULL))
++ return(0);
+
+ if (!no_name && (nid=OBJ_obj2nid(a)) != NID_undef)
+ {
+@@ -554,9 +555,10 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
+ i=(int)(l/40);
+ l-=(long)(i*40);
+ }
+- if (buf && (buf_len > 0))
++ if (buf && (buf_len > 1))
+ {
+ *buf++ = i + '0';
++ *buf = '\0';
+ buf_len--;
+ }
+ n++;
+@@ -571,9 +573,10 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
+ i = strlen(bndec);
+ if (buf)
+ {
+- if (buf_len > 0)
++ if (buf_len > 1)
+ {
+ *buf++ = '.';
++ *buf = '\0';
+ buf_len--;
+ }
+ BUF_strlcpy(buf,bndec,buf_len);
+@@ -807,4 +810,3 @@ err:
+ OPENSSL_free(buf);
+ return(ok);
+ }
+-
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Fix-SRP-buffer-overrun-vulnerability.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-SRP-buffer-overrun-vulnerability.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-SRP-buffer-overrun-vulnerability.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,42 @@
+From 47f27247f70d06830fe562d027c2aee60fe7ec6d Mon Sep 17 00:00:00 2001
+From: "Dr. Stephen Henson" <steve at openssl.org>
+Date: Thu, 31 Jul 2014 20:56:22 +0100
+Subject: [PATCH 13/16] Fix SRP buffer overrun vulnerability.
+
+Invalid parameters passed to the SRP code can be overrun an internal
+buffer. Add sanity check that g, A, B < N to SRP code.
+
+Thanks to Sean Devlin and Watson Ladd of Cryptography Services, NCC
+Group for reporting this issue.
+Reviewed-by: Kurt Roeckx <kurt at openssl.org>
+---
+ crypto/srp/srp_lib.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/crypto/srp/srp_lib.c b/crypto/srp/srp_lib.c
+index 7c1dcc5..83d417a 100644
+--- a/crypto/srp/srp_lib.c
++++ b/crypto/srp/srp_lib.c
+@@ -89,6 +89,9 @@ static BIGNUM *srp_Calc_k(BIGNUM *N, BIGNUM *g)
+ int longg ;
+ int longN = BN_num_bytes(N);
+
++ if (BN_ucmp(g, N) >= 0)
++ return NULL;
++
+ if ((tmp = OPENSSL_malloc(longN)) == NULL)
+ return NULL;
+ BN_bn2bin(N,tmp) ;
+@@ -121,6 +124,9 @@ BIGNUM *SRP_Calc_u(BIGNUM *A, BIGNUM *B, BIGNUM *N)
+ if ((A == NULL) ||(B == NULL) || (N == NULL))
+ return NULL;
+
++ if (BN_ucmp(A, N) >= 0 || BN_ucmp(B, N) >= 0)
++ return NULL;
++
+ longN= BN_num_bytes(N);
+
+ if ((cAB = OPENSSL_malloc(2*longN)) == NULL)
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Fix-SRP-ciphersuite-DoS-vulnerability.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-SRP-ciphersuite-DoS-vulnerability.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-SRP-ciphersuite-DoS-vulnerability.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,61 @@
+From b27973b2f58870488a05a1a3704f150a9d3af785 Mon Sep 17 00:00:00 2001
+From: "Dr. Stephen Henson" <steve at openssl.org>
+Date: Tue, 29 Jul 2014 21:23:30 +0100
+Subject: [PATCH 12/16] Fix SRP ciphersuite DoS vulnerability.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If a client attempted to use an SRP ciphersuite and it had not been
+set up correctly it would crash with a null pointer read. A malicious
+server could exploit this in a DoS attack.
+
+Thanks to Joonas Kuorilehto and Riku Hietamäki from Codenomicon
+for reporting this issue.
+
+CVE-2014-5139
+Reviewed-by: Tim Hudson <tjh at openssl.org>
+---
+ ssl/s3_clnt.c | 9 +++++++++
+ ssl/ssl_lib.c | 5 +++++
+ 2 files changed, 14 insertions(+)
+
+diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
+index df05f78..0aba7e5 100644
+--- a/ssl/s3_clnt.c
++++ b/ssl/s3_clnt.c
+@@ -954,6 +954,15 @@ int ssl3_get_server_hello(SSL *s)
+ SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED);
+ goto f_err;
+ }
++#ifndef OPENSSL_NO_SRP
++ if (((c->algorithm_mkey & SSL_kSRP) || (c->algorithm_auth & SSL_aSRP)) &&
++ !(s->srp_ctx.srp_Mask & SSL_kSRP))
++ {
++ al=SSL_AD_ILLEGAL_PARAMETER;
++ SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_WRONG_CIPHER_RETURNED);
++ goto f_err;
++ }
++#endif /* OPENSSL_NO_SRP */
+ p+=ssl_put_cipher_by_char(s,NULL,NULL);
+
+ sk=ssl_get_ciphers_by_id(s);
+diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
+index ef6258c..82a2c80 100644
+--- a/ssl/ssl_lib.c
++++ b/ssl/ssl_lib.c
+@@ -1406,6 +1406,11 @@ int ssl_cipher_list_to_bytes(SSL *s,STACK_OF(SSL_CIPHER) *sk,unsigned char *p,
+ s->psk_client_callback == NULL)
+ continue;
+ #endif /* OPENSSL_NO_PSK */
++#ifndef OPENSSL_NO_SRP
++ if (((c->algorithm_mkey & SSL_kSRP) || (c->algorithm_auth & SSL_aSRP)) &&
++ !(s->srp_ctx.srp_Mask & SSL_kSRP))
++ continue;
++#endif /* OPENSSL_NO_SRP */
+ j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p);
+ p+=j;
+ }
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Fix-memory-leak-from-zero-length-DTLS-fragments.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-memory-leak-from-zero-length-DTLS-fragments.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-memory-leak-from-zero-length-DTLS-fragments.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,79 @@
+From 9dbf4e95ef9491329877c628c51bcc8e644c9622 Mon Sep 17 00:00:00 2001
+From: Adam Langley <agl at imperialviolet.org>
+Date: Fri, 6 Jun 2014 14:30:33 -0700
+Subject: [PATCH 04/16] Fix memory leak from zero-length DTLS fragments.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The |pqueue_insert| function can fail if one attempts to insert a
+duplicate sequence number. When handling a fragment of an out of
+sequence message, |dtls1_process_out_of_seq_message| would not call
+|dtls1_reassemble_fragment| if the fragment's length was zero. It would
+then allocate a fresh fragment and attempt to insert it, but ignore the
+return value, leaking the fragment.
+
+This allows an attacker to exhaust the memory of a DTLS peer.
+
+Fixes CVE-2014-3507
+
+Reviewed-by: Matt Caswell <matt at openssl.org>
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+---
+ ssl/d1_both.c | 22 +++++++++++++++++++---
+ 1 file changed, 19 insertions(+), 3 deletions(-)
+
+Index: openssl-1.0.1e/ssl/d1_both.c
+===================================================================
+--- openssl-1.0.1e.orig/ssl/d1_both.c 2014-08-06 18:42:03.000000000 +0000
++++ openssl-1.0.1e/ssl/d1_both.c 2014-08-06 18:42:09.111245837 +0000
+@@ -610,6 +610,9 @@
+ msg_hdr->msg_len > dtls1_max_handshake_message_len(s))
+ goto err;
+
++ if (frag_len == 0)
++ return DTLS1_HM_FRAGMENT_RETRY;
++
+ /* Try to find item in queue */
+ memset(seq64be,0,sizeof(seq64be));
+ seq64be[6] = (unsigned char) (msg_hdr->seq>>8);
+@@ -687,7 +690,12 @@
+ i = -1;
+ }
+
+- pqueue_insert(s->d1->buffered_messages, item);
++ item = pqueue_insert(s->d1->buffered_messages, item);
++ /* pqueue_insert fails iff a duplicate item is inserted.
++ * However, |item| cannot be a duplicate. If it were,
++ * |pqueue_find|, above, would have returned it and control
++ * would never have reached this branch. */
++ OPENSSL_assert(item != NULL);
+ }
+
+ return DTLS1_HM_FRAGMENT_RETRY;
+@@ -745,7 +753,7 @@
+ }
+ else
+ {
+- if (frag_len && frag_len < msg_hdr->msg_len)
++ if (frag_len < msg_hdr->msg_len)
+ return dtls1_reassemble_fragment(s, msg_hdr, ok);
+
+ if (frag_len > dtls1_max_handshake_message_len(s))
+@@ -774,7 +782,15 @@
+ if ( item == NULL)
+ goto err;
+
+- pqueue_insert(s->d1->buffered_messages, item);
++ item = pqueue_insert(s->d1->buffered_messages, item);
++ /* pqueue_insert fails iff a duplicate item is inserted.
++ * However, |item| cannot be a duplicate. If it were,
++ * |pqueue_find|, above, would have returned it. Then, either
++ * |frag_len| != |msg_hdr->msg_len| in which case |item| is set
++ * to NULL and it will have been processed with
++ * |dtls1_reassemble_fragment|, above, or the record will have
++ * been discarded. */
++ OPENSSL_assert(item != NULL);
+ }
+
+ return DTLS1_HM_FRAGMENT_RETRY;
Added: openssl/branches/wheezy/debian/patches/Fix-protocol-downgrade-bug-in-case-of-fragmented-pac.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-protocol-downgrade-bug-in-case-of-fragmented-pac.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-protocol-downgrade-bug-in-case-of-fragmented-pac.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,86 @@
+From 9c1a0fa0cf487693dac882ae771a1a28edca4477 Mon Sep 17 00:00:00 2001
+From: David Benjamin <davidben at google.com>
+Date: Wed, 23 Jul 2014 22:32:21 +0200
+Subject: [PATCH 08/16] Fix protocol downgrade bug in case of fragmented
+ packets
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+CVE-2014-3511
+
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+Reviewed-by: Bodo Möller <bodo at openssl.org>
+---
+ ssl/s23_srvr.c | 30 +++++++++++++++++++++++-------
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+diff --git a/ssl/s23_srvr.c b/ssl/s23_srvr.c
+index 4877849..2901a6b 100644
+--- a/ssl/s23_srvr.c
++++ b/ssl/s23_srvr.c
+@@ -348,23 +348,19 @@ int ssl23_get_client_hello(SSL *s)
+ * Client Hello message, this would be difficult, and we'd have
+ * to read more records to find out.
+ * No known SSL 3.0 client fragments ClientHello like this,
+- * so we simply assume TLS 1.0 to avoid protocol version downgrade
+- * attacks. */
++ * so we simply reject such connections to avoid
++ * protocol version downgrade attacks. */
+ if (p[3] == 0 && p[4] < 6)
+ {
+-#if 0
+ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_SMALL);
+ goto err;
+-#else
+- v[1] = TLS1_VERSION_MINOR;
+-#endif
+ }
+ /* if major version number > 3 set minor to a value
+ * which will use the highest version 3 we support.
+ * If TLS 2.0 ever appears we will need to revise
+ * this....
+ */
+- else if (p[9] > SSL3_VERSION_MAJOR)
++ if (p[9] > SSL3_VERSION_MAJOR)
+ v[1]=0xff;
+ else
+ v[1]=p[10]; /* minor version according to client_version */
+@@ -444,14 +440,34 @@ int ssl23_get_client_hello(SSL *s)
+ v[0] = p[3]; /* == SSL3_VERSION_MAJOR */
+ v[1] = p[4];
+
++ /* An SSLv3/TLSv1 backwards-compatible CLIENT-HELLO in an SSLv2
++ * header is sent directly on the wire, not wrapped as a TLS
++ * record. It's format is:
++ * Byte Content
++ * 0-1 msg_length
++ * 2 msg_type
++ * 3-4 version
++ * 5-6 cipher_spec_length
++ * 7-8 session_id_length
++ * 9-10 challenge_length
++ * ... ...
++ */
+ n=((p[0]&0x7f)<<8)|p[1];
+ if (n > (1024*4))
+ {
+ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_TOO_LARGE);
+ goto err;
+ }
++ if (n < 9)
++ {
++ SSLerr(SSL_F_SSL23_GET_CLIENT_HELLO,SSL_R_RECORD_LENGTH_MISMATCH);
++ goto err;
++ }
+
+ j=ssl23_read_bytes(s,n+2);
++ /* We previously read 11 bytes, so if j > 0, we must have
++ * j == n+2 == s->packet_length. We have at least 11 valid
++ * packet bytes. */
+ if (j <= 0) return(j);
+
+ ssl3_finish_mac(s, s->packet+2, s->packet_length-2);
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Fix-race-condition-in-ssl_parse_serverhello_tlsext.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-race-condition-in-ssl_parse_serverhello_tlsext.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-race-condition-in-ssl_parse_serverhello_tlsext.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,45 @@
+From d30b9cb1ac7ec41188689363bbef94d7023b21e3 Mon Sep 17 00:00:00 2001
+From: Gabor Tyukasz <Gabor.Tyukasz at logmein.com>
+Date: Wed, 23 Jul 2014 23:42:06 +0200
+Subject: [PATCH 11/16] Fix race condition in ssl_parse_serverhello_tlsext
+
+CVE-2014-3509
+Reviewed-by: Tim Hudson <tjh at openssl.org>
+Reviewed-by: Dr. Stephen Henson <steve at openssl.org>
+---
+ ssl/t1_lib.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
+index 8167a51..022a4fb 100644
+--- a/ssl/t1_lib.c
++++ b/ssl/t1_lib.c
+@@ -1555,15 +1555,18 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in
+ *al = TLS1_AD_DECODE_ERROR;
+ return 0;
+ }
+- s->session->tlsext_ecpointformatlist_length = 0;
+- if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
+- if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
++ if (!s->hit)
+ {
+- *al = TLS1_AD_INTERNAL_ERROR;
+- return 0;
++ s->session->tlsext_ecpointformatlist_length = 0;
++ if (s->session->tlsext_ecpointformatlist != NULL) OPENSSL_free(s->session->tlsext_ecpointformatlist);
++ if ((s->session->tlsext_ecpointformatlist = OPENSSL_malloc(ecpointformatlist_length)) == NULL)
++ {
++ *al = TLS1_AD_INTERNAL_ERROR;
++ return 0;
++ }
++ s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
++ memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
+ }
+- s->session->tlsext_ecpointformatlist_length = ecpointformatlist_length;
+- memcpy(s->session->tlsext_ecpointformatlist, sdata, ecpointformatlist_length);
+ #if 0
+ fprintf(stderr,"ssl_parse_serverhello_tlsext s->session->tlsext_ecpointformatlist ");
+ sdata = s->session->tlsext_ecpointformatlist;
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Fix-return-code-for-truncated-DTLS-fragment.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Fix-return-code-for-truncated-DTLS-fragment.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Fix-return-code-for-truncated-DTLS-fragment.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,43 @@
+From 4118b13c0c191e3d5dcd5c73e37b19b49c5381e1 Mon Sep 17 00:00:00 2001
+From: Adam Langley <agl at imperialviolet.org>
+Date: Fri, 6 Jun 2014 14:44:20 -0700
+Subject: [PATCH 05/16] Fix return code for truncated DTLS fragment.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Previously, a truncated DTLS fragment in
+|dtls1_process_out_of_seq_message| would cause *ok to be cleared, but
+the return value would still be the number of bytes read. This would
+cause |dtls1_get_message| not to consider it an error and it would
+continue processing as normal until the calling function noticed that
+*ok was zero.
+
+I can't see an exploit here because |dtls1_get_message| uses
+|s->init_num| as the length, which will always be zero from what I can
+see.
+
+Reviewed-by: Matt Caswell <matt at openssl.org>
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+---
+ ssl/d1_both.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
+index bb52d92..ac0fcaa 100644
+--- a/ssl/d1_both.c
++++ b/ssl/d1_both.c
+@@ -771,7 +771,9 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ /* read the body of the fragment (header has already been read */
+ i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
+ frag->fragment,frag_len,0);
+- if (i<=0 || (unsigned long)i!=frag_len)
++ if ((unsigned long)i!=frag_len)
++ i = -1;
++ if (i<=0)
+ goto err;
+ }
+
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/Remove-some-duplicate-DTLS-code.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/Remove-some-duplicate-DTLS-code.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/Remove-some-duplicate-DTLS-code.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,86 @@
+From c3d1cad0a04b8ed785f57508c2fd8eb8c314bcc7 Mon Sep 17 00:00:00 2001
+From: Adam Langley <agl at imperialviolet.org>
+Date: Fri, 6 Jun 2014 14:47:07 -0700
+Subject: [PATCH 07/16] Remove some duplicate DTLS code.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In a couple of functions, a sequence number would be calculated twice.
+
+Additionally, in |dtls1_process_out_of_seq_message|, we know that
+|frag_len| <= |msg_hdr->msg_len| so the later tests for |frag_len <
+msg_hdr->msg_len| can be more clearly written as |frag_len !=
+msg_hdr->msg_len|, since that's the only remaining case.
+
+Reviewed-by: Matt Caswell <matt at openssl.org>
+Reviewed-by: Emilia Käsper <emilia at openssl.org>
+---
+ ssl/d1_both.c | 16 ++++------------
+ 1 file changed, 4 insertions(+), 12 deletions(-)
+
+diff --git a/ssl/d1_both.c b/ssl/d1_both.c
+index ea8f340..89cdca8 100644
+--- a/ssl/d1_both.c
++++ b/ssl/d1_both.c
+@@ -599,7 +599,7 @@ static unsigned long dtls1_max_handshake_message_len(const SSL *s)
+ }
+
+ static int
+-dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
++dtls1_reassemble_fragment(SSL *s, const struct hm_header_st* msg_hdr, int *ok)
+ {
+ hm_fragment *frag = NULL;
+ pitem *item = NULL;
+@@ -682,10 +682,6 @@ dtls1_reassemble_fragment(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+
+ if (item == NULL)
+ {
+- memset(seq64be,0,sizeof(seq64be));
+- seq64be[6] = (unsigned char)(msg_hdr->seq>>8);
+- seq64be[7] = (unsigned char)(msg_hdr->seq);
+-
+ item = pitem_new(seq64be, frag);
+ if (item == NULL)
+ {
+@@ -711,7 +707,7 @@ err:
+
+
+ static int
+-dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
++dtls1_process_out_of_seq_message(SSL *s, const struct hm_header_st* msg_hdr, int *ok)
+ {
+ int i=-1;
+ hm_fragment *frag = NULL;
+@@ -731,7 +727,7 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ /* If we already have an entry and this one is a fragment,
+ * don't discard it and rather try to reassemble it.
+ */
+- if (item != NULL && frag_len < msg_hdr->msg_len)
++ if (item != NULL && frag_len != msg_hdr->msg_len)
+ item = NULL;
+
+ /* Discard the message if sequence number was already there, is
+@@ -756,7 +752,7 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ }
+ else
+ {
+- if (frag_len < msg_hdr->msg_len)
++ if (frag_len != msg_hdr->msg_len)
+ return dtls1_reassemble_fragment(s, msg_hdr, ok);
+
+ if (frag_len > dtls1_max_handshake_message_len(s))
+@@ -779,10 +775,6 @@ dtls1_process_out_of_seq_message(SSL *s, struct hm_header_st* msg_hdr, int *ok)
+ goto err;
+ }
+
+- memset(seq64be,0,sizeof(seq64be));
+- seq64be[6] = (unsigned char)(msg_hdr->seq>>8);
+- seq64be[7] = (unsigned char)(msg_hdr->seq);
+-
+ item = pitem_new(seq64be, frag);
+ if ( item == NULL)
+ goto err;
+--
+2.0.1
+
Added: openssl/branches/wheezy/debian/patches/SRP-ciphersuite-correction.patch
===================================================================
--- openssl/branches/wheezy/debian/patches/SRP-ciphersuite-correction.patch (rev 0)
+++ openssl/branches/wheezy/debian/patches/SRP-ciphersuite-correction.patch 2014-08-11 19:37:26 UTC (rev 690)
@@ -0,0 +1,95 @@
+From 18c7f2fce8a82b13506cac7ca69fc333baf76408 Mon Sep 17 00:00:00 2001
+From: "Dr. Stephen Henson" <steve at openssl.org>
+Date: Mon, 9 Jun 2014 12:03:12 +0100
+Subject: [PATCH] SRP ciphersuite correction.
+
+SRP ciphersuites do not have no authentication. They have authentication
+based on SRP. Add new SRP authentication flag and cipher string.
+(cherry picked from commit a86b88acc373ac1fb0ca709a5fb8a8fa74683f67)
+---
+ ssl/s3_lib.c | 6 +++---
+ ssl/ssl.h | 1 +
+ ssl/ssl_ciph.c | 4 ++++
+ ssl/ssl_locl.h | 1 +
+ 4 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
+index 36dd1f6..4835bef 100644
+--- a/ssl/s3_lib.c
++++ b/ssl/s3_lib.c
+@@ -2426,7 +2426,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
+ TLS1_TXT_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+ TLS1_CK_SRP_SHA_WITH_3DES_EDE_CBC_SHA,
+ SSL_kSRP,
+- SSL_aNULL,
++ SSL_aSRP,
+ SSL_3DES,
+ SSL_SHA1,
+ SSL_TLSV1,
+@@ -2474,7 +2474,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
+ TLS1_TXT_SRP_SHA_WITH_AES_128_CBC_SHA,
+ TLS1_CK_SRP_SHA_WITH_AES_128_CBC_SHA,
+ SSL_kSRP,
+- SSL_aNULL,
++ SSL_aSRP,
+ SSL_AES128,
+ SSL_SHA1,
+ SSL_TLSV1,
+@@ -2522,7 +2522,7 @@ OPENSSL_GLOBAL SSL_CIPHER ssl3_ciphers[]={
+ TLS1_TXT_SRP_SHA_WITH_AES_256_CBC_SHA,
+ TLS1_CK_SRP_SHA_WITH_AES_256_CBC_SHA,
+ SSL_kSRP,
+- SSL_aNULL,
++ SSL_aSRP,
+ SSL_AES256,
+ SSL_SHA1,
+ SSL_TLSV1,
+diff --git a/ssl/ssl.h b/ssl/ssl.h
+index 4c1242c..a9b15d4 100644
+--- a/ssl/ssl.h
++++ b/ssl/ssl.h
+@@ -264,6 +264,7 @@ extern "C" {
+ #define SSL_TXT_aGOST94 "aGOST94"
+ #define SSL_TXT_aGOST01 "aGOST01"
+ #define SSL_TXT_aGOST "aGOST"
++#define SSL_TXT_aSRP "aSRP"
+
+ #define SSL_TXT_DSS "DSS"
+ #define SSL_TXT_DH "DH"
+diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
+index 0aba8e0..06da26a 100644
+--- a/ssl/ssl_ciph.c
++++ b/ssl/ssl_ciph.c
+@@ -270,6 +270,7 @@ static const SSL_CIPHER cipher_aliases[]={
+ {0,SSL_TXT_aGOST94,0,0,SSL_aGOST94,0,0,0,0,0,0,0},
+ {0,SSL_TXT_aGOST01,0,0,SSL_aGOST01,0,0,0,0,0,0,0},
+ {0,SSL_TXT_aGOST,0,0,SSL_aGOST94|SSL_aGOST01,0,0,0,0,0,0,0},
++ {0,SSL_TXT_aSRP,0, 0,SSL_aSRP, 0,0,0,0,0,0,0},
+
+ /* aliases combining key exchange and server authentication */
+ {0,SSL_TXT_EDH,0, SSL_kEDH,~SSL_aNULL,0,0,0,0,0,0,0},
+@@ -1628,6 +1629,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
+ case SSL_aPSK:
+ au="PSK";
+ break;
++ case SSL_aSRP:
++ au="SRP";
++ break;
+ default:
+ au="unknown";
+ break;
+diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
+index e485907..eb4d8f2 100644
+--- a/ssl/ssl_locl.h
++++ b/ssl/ssl_locl.h
+@@ -311,6 +311,7 @@
+ #define SSL_aPSK 0x00000080L /* PSK auth */
+ #define SSL_aGOST94 0x00000100L /* GOST R 34.10-94 signature auth */
+ #define SSL_aGOST01 0x00000200L /* GOST R 34.10-2001 signature auth */
++#define SSL_aSRP 0x00000400L /* SRP auth */
+
+
+ /* Bits for algorithm_enc (symmetric encryption) */
+--
+2.0.1
+
Modified: openssl/branches/wheezy/debian/patches/series
===================================================================
--- openssl/branches/wheezy/debian/patches/series 2014-08-11 19:36:05 UTC (rev 689)
+++ openssl/branches/wheezy/debian/patches/series 2014-08-11 19:37:26 UTC (rev 690)
@@ -53,3 +53,19 @@
CVE-2014-0195.patch
CVE-2014-0221.patch
CVE-2012-4929.patch
+Avoid-double-free-when-processing-DTLS-packets.patch
+Added-comment-for-the-frag-reassembly-NULL-case-as-p.patch
+Fix-DTLS-handshake-message-size-checks.patch
+Fix-memory-leak-from-zero-length-DTLS-fragments.patch
+Fix-return-code-for-truncated-DTLS-fragment.patch
+Applying-same-fix-as-in-dtls1_process_out_of_seq_mes.patch
+Remove-some-duplicate-DTLS-code.patch
+Fix-protocol-downgrade-bug-in-case-of-fragmented-pac.patch
+Fix-DTLS-anonymous-EC-DH-denial-of-service.patch
+Fix-OID-handling.patch
+Fix-race-condition-in-ssl_parse_serverhello_tlsext.patch
+SRP-ciphersuite-correction.patch
+Fix-SRP-ciphersuite-DoS-vulnerability.patch
+Fix-SRP-buffer-overrun-vulnerability.patch
+Check-SRP-parameters-early.patch
+
More information about the Pkg-openssl-changes
mailing list