[Pkg-openssl-changes] r367 - in openssl/branches/etch: apps crypto/x509v3 debian ssl

Kurt Roeckx kroeckx at alioth.debian.org
Sat May 16 15:06:19 UTC 2009


Author: kroeckx
Date: 2009-05-16 15:06:19 +0000 (Sat, 16 May 2009)
New Revision: 367

Modified:
   openssl/branches/etch/apps/speed.c
   openssl/branches/etch/apps/spkac.c
   openssl/branches/etch/apps/verify.c
   openssl/branches/etch/apps/x509.c
   openssl/branches/etch/crypto/x509v3/v3_utl.c
   openssl/branches/etch/debian/changelog
   openssl/branches/etch/ssl/s2_clnt.c
   openssl/branches/etch/ssl/s2_srvr.c
   openssl/branches/etch/ssl/s3_clnt.c
   openssl/branches/etch/ssl/s3_srvr.c
   openssl/branches/etch/ssl/ssltest.c
Log:
* Internal calls to didn't properly check for errors which
  resulted in malformed DSA and ECDSA signatures being treated as
  a good signature rather than as an error.  (CVE-2008-5077)
* ipv6_from_asc() could write 1 byte longer than the buffer in case
  the ipv6 address didn't have "::" part.


Modified: openssl/branches/etch/apps/speed.c
===================================================================
--- openssl/branches/etch/apps/speed.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/apps/speed.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -2038,7 +2038,7 @@
 				{
 				ret=RSA_verify(NID_md5_sha1, buf,36, buf2,
 					rsa_num, rsa_key[j]);
-				if (ret == 0)
+				if (ret <= 0)
 					{
 					BIO_printf(bio_err,
 						"RSA verify failure\n");

Modified: openssl/branches/etch/apps/spkac.c
===================================================================
--- openssl/branches/etch/apps/spkac.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/apps/spkac.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -285,7 +285,7 @@
 	pkey = NETSCAPE_SPKI_get_pubkey(spki);
 	if(verify) {
 		i = NETSCAPE_SPKI_verify(spki, pkey);
-		if(i) BIO_printf(bio_err, "Signature OK\n");
+		if (i > 0) BIO_printf(bio_err, "Signature OK\n");
 		else {
 			BIO_printf(bio_err, "Signature Failure\n");
 			ERR_print_errors(bio_err);

Modified: openssl/branches/etch/apps/verify.c
===================================================================
--- openssl/branches/etch/apps/verify.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/apps/verify.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -266,7 +266,7 @@
 
 	ret=0;
 end:
-	if (i)
+	if (i > 0)
 		{
 		fprintf(stdout,"OK\n");
 		ret=1;

Modified: openssl/branches/etch/apps/x509.c
===================================================================
--- openssl/branches/etch/apps/x509.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/apps/x509.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -1144,7 +1144,7 @@
 	/* NOTE: this certificate can/should be self signed, unless it was
 	 * a certificate request in which case it is not. */
 	X509_STORE_CTX_set_cert(&xsc,x);
-	if (!reqfile && !X509_verify_cert(&xsc))
+	if (!reqfile && X509_verify_cert(&xsc) <= 0)
 		goto end;
 
 	if (!X509_check_private_key(xca,pkey))

Modified: openssl/branches/etch/crypto/x509v3/v3_utl.c
===================================================================
--- openssl/branches/etch/crypto/x509v3/v3_utl.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/crypto/x509v3/v3_utl.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -713,17 +713,20 @@
 
 	/* Format result */
 
-	/* Copy initial part */
-	if (v6stat.zero_pos > 0)
+	if (v6stat.zero_pos >= 0)
+		{
+		/* Copy initial part */
 		memcpy(v6, v6stat.tmp, v6stat.zero_pos);
-	/* Zero middle */
-	if (v6stat.total != 16)
+		/* Zero middle */
 		memset(v6 + v6stat.zero_pos, 0, 16 - v6stat.total);
-	/* Copy final part */
-	if (v6stat.total != v6stat.zero_pos)
-		memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
-			v6stat.tmp + v6stat.zero_pos,
-			v6stat.total - v6stat.zero_pos);
+		/* Copy final part */
+		if (v6stat.total != v6stat.zero_pos)
+			memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
+				v6stat.tmp + v6stat.zero_pos,
+				v6stat.total - v6stat.zero_pos);
+		}
+	else
+		memcpy(v6, v6stat.tmp, 16);
 
 	return 1;
 	}

Modified: openssl/branches/etch/debian/changelog
===================================================================
--- openssl/branches/etch/debian/changelog	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/debian/changelog	2009-05-16 15:06:19 UTC (rev 367)
@@ -1,3 +1,13 @@
+openssl (0.9.8c-4etch4) stable-security; urgency=low
+
+  * Internal calls to didn't properly check for errors which
+    resulted in malformed DSA and ECDSA signatures being treated as
+    a good signature rather than as an error.  (CVE-2008-5077)
+  * ipv6_from_asc() could write 1 byte longer than the buffer in case
+    the ipv6 address didn't have "::" part.
+
+ -- Kurt Roeckx <kurt at roeckx.be>  Mon, 05 Jan 2009 00:20:10 +0100
+
 openssl (0.9.8c-4etch3) stable-security; urgency=high
 
   * Re-introducing seeding of the random number generator.  Patch from the

Modified: openssl/branches/etch/ssl/s2_clnt.c
===================================================================
--- openssl/branches/etch/ssl/s2_clnt.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/ssl/s2_clnt.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -1044,7 +1044,7 @@
 
 	i=ssl_verify_cert_chain(s,sk);
 		
-	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
+	if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0))
 		{
 		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
 		goto err;

Modified: openssl/branches/etch/ssl/s2_srvr.c
===================================================================
--- openssl/branches/etch/ssl/s2_srvr.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/ssl/s2_srvr.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -1054,7 +1054,7 @@
 
 	i=ssl_verify_cert_chain(s,sk);
 
-	if (i)	/* we like the packet, now check the chksum */
+	if (i > 0)	/* we like the packet, now check the chksum */
 		{
 		EVP_MD_CTX ctx;
 		EVP_PKEY *pkey=NULL;
@@ -1083,7 +1083,7 @@
 		EVP_PKEY_free(pkey);
 		EVP_MD_CTX_cleanup(&ctx);
 
-		if (i) 
+		if (i > 0) 
 			{
 			if (s->session->peer != NULL)
 				X509_free(s->session->peer);

Modified: openssl/branches/etch/ssl/s3_clnt.c
===================================================================
--- openssl/branches/etch/ssl/s3_clnt.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/ssl/s3_clnt.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -883,7 +883,7 @@
 		}
 
 	i=ssl_verify_cert_chain(s,sk);
-	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
+	if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
 #ifndef OPENSSL_NO_KRB5
 	        && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
 	        != (SSL_aKRB5|SSL_kKRB5)
@@ -1368,7 +1368,7 @@
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,param,param_len);
-			if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+			if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
 				{
 				/* bad signature */
 				al=SSL_AD_DECRYPT_ERROR;
@@ -1386,7 +1386,7 @@
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,param,param_len);
-			if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+			if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
 				{
 				/* bad signature */
 				al=SSL_AD_DECRYPT_ERROR;

Modified: openssl/branches/etch/ssl/s3_srvr.c
===================================================================
--- openssl/branches/etch/ssl/s3_srvr.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/ssl/s3_srvr.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -2460,7 +2460,7 @@
 	else
 		{
 		i=ssl_verify_cert_chain(s,sk);
-		if (!i)
+		if (i <= 0)
 			{
 			al=ssl_verify_alarm_type(s->verify_result);
 			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);

Modified: openssl/branches/etch/ssl/ssltest.c
===================================================================
--- openssl/branches/etch/ssl/ssltest.c	2009-05-16 15:04:03 UTC (rev 366)
+++ openssl/branches/etch/ssl/ssltest.c	2009-05-16 15:06:19 UTC (rev 367)
@@ -2072,7 +2072,7 @@
 
 	if (cb_arg->proxy_auth)
 		{
-		if (ok)
+		if (ok > 0)
 			{
 			const char *cond_end = NULL;
 




More information about the Pkg-openssl-changes mailing list