[Full-Disclosure] NetBSD Security Advisory 2003-005: RSA timing attack in OpenSSL code

From: NetBSD Security Officer (security-officer@netbsd.org)
Date: 03/26/03

  • Next message: NetBSD Security Officer: "[Full-Disclosure] NetBSD Security Advisory 2003-008: faulty length checks in xdrmem_getbytes" 
    From: NetBSD Security Officer <security-officer@netbsd.org>
To: full-disclosure@lists.netsys.com
Date: Wed, 26 Mar 2003 13:56:47 -0500

    -----BEGIN PGP SIGNED MESSAGE-----

                     NetBSD Security Advisory 2003-005
                     =================================

    Topic: RSA timing attack in OpenSSL code

    Version: NetBSD-current: source prior to March 19, 2003
                    NetBSD-1.6: affected (NetBSD-1.6.1 will include the fix)
                    NetBSD-1.5.3: affected
                    NetBSD-1.5.2: affected
                    NetBSD-1.5.1: affected
                    NetBSD-1.5: affected
                    NetBSD-1.4*: not affected
                    pkgsrc: prior to openssl-0.9.6gnb2

    Severity: Cryptographic keys can be compromised remotely.

    Fixed: NetBSD-current: March 19, 2003
                    NetBSD-1.6 branch: March 21, 2003 (1.6.1 will include the fix)
                    NetBSD-1.5 branch: March 21, 2003
                    pkgsrc: openssl-0.9.6gnb2

    Abstract
    ========

    A timing attack has been discovered, which can be used against OpenSSL.
    The attack allows remote recovery of private keys, from a host with
    low-latency access to the server - such as the local host, or a host on
    the LAN.

    Research shows that about a million queries are sufficient to extract a
    1024-bit RSA key. Any program that uses OpenSSL's RSA logic could be
    affected.

    NOTE: Two OpenSSL advisories have appeared within 2 days of each other.
            while the patches affect libcrypto in this SA, and libssl in
            2003-007, please be aware that there are two separate issues
            with separate sets of patches.

    Technical Details
    =================

    http://crypto.stanford.edu/~dabo/abstracts/ssl-timing.html

    Solutions and Workarounds
    =========================

    The following instructions describe how to upgrade your libcrypto
    binaries by updating your source tree and rebuilding and installing
    a new version of libcrypto.

    Be sure to restart running instances of programs that use the libcrypto
    library after upgrading.

    If you have any statically-linked binaries that linked against a
    vulnerable libcrypto, you need to recompile them.

    * NetBSD-current:

            Systems running NetBSD-current dated from before 2003-03-19
            should be upgraded to NetBSD-current dated 2003-03-19 or later.

            The following file needs to be updated from the
            netbsd-current CVS branch (aka HEAD):
            crypto/dist/openssl/crypto/rsa

            To update from CVS, re-build, and re-install libcrypto:
                    # cd src
                    # cvs update -d -P crypto/dist/openssl/crypto/rsa
                    # cd lib/libcrypto
                    # make USETOOLS=no cleandir dependall
                    # make USETOOLS=no install

    * NetBSD 1.6:

            The binary distribution of NetBSD 1.6 is vulnerable.

            Systems running NetBSD-1-6 from sources dated before 2002-03-21
            should be upgraded to NetBSD-1-6 branch sources dated 2003-03-21
            or later.

            The following files need to be updated from the
            netbsd-1-6 CVS branch:
                    crypto/dist/openssl/crypto/rsa

            To update from CVS, re-build, and re-install libcrypto:
                    # cd src
                    # cvs update -d -P -r netbsd-1-6 crypto/dist/openssl/crypto/rsa
                    # cd lib/libcrypto
                    # make USETOOLS=no cleandir dependall
                    # make USETOOLS=no install

    * NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

            The binary distribution of NetBSD 1.5.3 is vulnerable.

            Systems running NetBSD-1.5.x dated from before 2003-xx-xx
            should be upgraded to NetBSD-1.5 branch dated 2003-xx-xx or later.

            The following file needs to be updated from the
            netbsd-1-5 CVS branch:
                    crypto/dist/openssl/crypto/rsa

            To update from CVS, re-build, and re-install libcrypto:
                    # cd src
                    # cvs update -d -P -r netbsd-1-5 \
                            crypto/dist/openssl/ssl/s3_pkt.c
                    # cd lib/libcrypto
                    # make cleandir dependall
                    # make install

    * NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:

            OpenSSL was not included in the base system in NetBSD-1.4.*
            Follow the directions for pkgsrc if you have installed it from
            pkgsrc.

    * pkgsrc:

            openssl (pkgsrc/security/openssl) prior to 0.9.6gnb2 are
            vulnerable. Upgrade to openssl-0.9.6gnb2 or later; pkgsrc
            currently contains openssl-0.9.6gnb1 at time of this writing.

            Packages which require openssl can be found by running 'pkg_info
            openssl'. Depending on the method you choose to update pkgsrc
            packages, a rebuild of the packages on that list may be
            performed for you by the package system. If you update using the
            experimental 'make replace' target, you will need to manually
            update any packages which build static binaries with libcrypto.a.

            If you have statically linked binaries in pkgsrc, they have to be
            rebuilt. Statically linked binaries can be identified by the
            following command (note: be sure to include the directory you install
            pkgsrc binaries to, if you've changed LOCALBASE from the default of
            /usr/pkg)

                    file /usr/pkg/{bin,sbin,libexec}/* | grep static

    Thanks To
    =========

    Bugtraq and the OpenSSL team.

    Revision History
    ================

            2003-03-26 Initial release

    More Information
    ================

    An up-to-date PGP signed copy of this release will be maintained at
      ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-005.txt.asc

    Information about NetBSD and NetBSD security can be found at
    http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.

    Copyright 2003, The NetBSD Foundation, Inc. All Rights Reserved.

    $NetBSD: NetBSD-SA2003-005.txt,v 1.7 2003/03/26 06:14:37 david Exp $

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.6 (NetBSD)
    Comment: For info see http://www.gnupg.org

    iQCVAwUBPoHNyD5Ru2/4N2IFAQG6WgP+JRQkdq9QfurZtV5syPwd6SeD6f3k60u0
    wSKvPq8mk+dcgwetQ8RnHw+yf3bRNb1YZOT2o5zwyBw13YQ3B/R2iTGX8OKu/Iol
    1+OEY4vUX2Ttq76W6RweZGBI8+1tkCuWprvP7i+LFdffKUX0Hv2CiJNnymcRxLLl
    WHxB7V9b1Hw=
    =sJ8t
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: NetBSD Security Officer: "[Full-Disclosure] NetBSD Security Advisory 2003-008: faulty length checks in xdrmem_getbytes"

    Relevant Pages