PT-2009-2818 · Openssl · Openssl

Jan Lieskovsky · Published 2009-01-15 · Updated 2009-02-06 · CVE-2009-0124

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions tqsllib version 2.0

Description The issue arises from the tqsl verifyDataBlock function in openssl cert.cpp, which fails to properly check the return value from the OpenSSL EVP VerifyFinal function. This allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature.

Recommendations For tqsllib version 2.0, ensure that the tqsl verifyDataBlock function correctly checks the return value from the OpenSSL EVP VerifyFinal function to prevent bypassing of certificate chain validation. As a temporary workaround, consider restricting the use of the tqsl verifyDataBlock function until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0124

Affected Products

Openssl

References · 6

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511509 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0124 · Security Note
• https://redhat.com/archives/fedora-package-announce/2009-January/msg00557.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=479650 · Note
• http://openwall.com/lists/oss-security/2009/01/12/4 · Note
• http://secunia.com/advisories/33543 · Note