Out of bounds read in OpenSSL function X509_cmp_time (CVE-2015-1789) and other minor issues

[Hanno Böck <hanno () hboeck de>]

https://blog.fuzzing-project.org/15-Out-of-bounds-read-in-OpenSSL-function-X509_cmp_time-CVE-2015-1789-and-other-minor-issues.html

Lately I started an effort to systematically fuzz all possible file
input vectors of OpenSSL. This led to the discovery of one potential
security issue and two minor non-security fixes.

Malformed inputs can cause an out of bounds heap read access in the
function X509_cmp_time. This issue was reported to the OpenSSL
developers on 11th March. It was independently discovered three days
earlier by Google developer Robert Swiecki.

During the fuzzing I also discovered several issues in the parser of
ASN1 definition files. These can be used to create ASN1 data structures
with OpenSSL. It is unlikely that there is any situation where ASN1
definitions are attacker controlled, therefore these are not considered
security issues.

The latest security updates of OpenSSL (1.0.2b, 1.0.1n, 1.0.0s,
0.9.8zg) fix all three issues. These releases also fix a number of
other security issues. Shortly after publishing these updates OpenSSL
issued another update (1.0.2c, 1.0.1o), because the versions contained
an ABI change which should not happen in minor releases.

I am aware that a couple of other people were also fuzzing OpenSSL
lately. Noteworthy is one issue that was found by Joseph Birr-Pixton in
the parser of elliptic curve parameters. It is an endless loop and can
be used to hang processes with a high CPU load. Endless loop issues
tend to get ignored because they are often false positives.
https://jbp.io/2015/06/11/cve-2015-1788-openssl-binpoly-hang/

It is definitely getting harder finding any new issues through fuzzing
in OpenSSL. This is good news.

Out of bounds read in X509_cmp_time
CVE-2015-1789
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1789
Git commit / fix
https://github.com/openssl/openssl/commit/f48b83b4fb7d6689584cf25f61ca63a4891f5b11
OpenSSL Security Advisory
https://openssl.org/news/secadv_20150611.txt
Sample malformed cert (test with openssl verify [input])
https://crashes.fuzzing-project.org/openssl-verify-oob.crt

Samples for issues in ASN1 definition parser (test with openssl
asn1parse -genconf [input]): Out of bounds read heap
https://crashes.fuzzing-project.org/openssl-asn1-oob.asn
Stack overflow through endless recursion
https://crashes.fuzzing-project.org/openssl-asn1-stack.asn
Uninitialized memory access
https://crashes.fuzzing-project.org/openssl-asn1-uninitialized.asn

-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: BBB51E42

Attachment: _bin
Description: OpenPGP digital signature