PT-2009-2818 · Openssl · Openssl

Jan Lieskovsky · Publicado 2009-01-15 · Atualizado 2009-02-06 · CVE-2009-0124

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions tqsllib version 2.0

Description The issue arises from the tqsl verifyDataBlock function in openssl cert.cpp, which fails to properly check the return value from the OpenSSL EVP VerifyFinal function. This allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature.

Recommendations For tqsllib version 2.0, ensure that the tqsl verifyDataBlock function correctly checks the return value from the OpenSSL EVP VerifyFinal function to prevent bypassing of certificate chain validation. As a temporary workaround, consider restricting the use of the tqsl verifyDataBlock function until a patch is available.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-0124

Produtos afetados

Openssl

Referências · 6

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511509 · Exploit
• https://bugzilla.redhat.com/show_bug.cgi?id=479650 · Nota
• http://openwall.com/lists/oss-security/2009/01/12/4 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0124 · Nota de Segurança
• http://secunia.com/advisories/33543 · Nota
• https://redhat.com/archives/fedora-package-announce/2009-January/msg00557.html · Aviso do Fabricante