Re: OpenSSL Hacks

Douglas A. Gwyn wrote:
Buffer overrun is
possible on many platforms when a null pointer is used as though it
pointed to allocated storage,

I do not know of any widely used platform where this is the case. Do you?

Like I said before, buffer overrun may well be possible on some obscure
platforms that are not widely used, or on hypothetical platforms that
exist only in our imagination but are not ruled out by the C standard.
I don't dispute that. One can easily come up with dozens of examples of
imaginary platforms where this is the case. The question is whether it
is a real issue for real platforms in widespread use. I do not believe
it is. On the platforms that I'm familiar with, dereferencing a null
pointer will cause the program to trap and terminate prematurely, but
will not cause a buffer overrun.

Second, if a component of a protocol suddenly quits, the effect
can be quite varied depending on the context. Unhandled violation
of a protocol could have serious security consequences, especially
when the implementation is oblivious to that possibility.

If you design a system where premature termination of any one process
can cause integrity or confidentiality failures of the whole system,
then you've got bigger problems. Like I wrote earlier, there are usually
a gazillion ways to perform a denial-of-service attack on a component,
or on the whole system. If the system has been architectured in such
a way that a successful denial-of-service attack on one component can
harm the integrity or confidentiality of the system as a whole, then
you've probably got problems whether you use OpenSSL or not. If your
system has been architected in that way, the correct fix is to change
the architecture.

Of course, there are some applications where availability and resistance
to denial-of-service are a crucial security goal. In those applications,
OpenSSL may be the wrong tool for the job. But my experience is that
those cases are pretty rare, when it comes to Internet-connected apps.
Most Internet-connected apps that I have ever inspected are vulnerable
to some sort of denial-of-service attack or another, and users just don't
care all that much.

Third, the unchecked malloc issue was just one example I gave that
I thought would be noncontroversial.

Well, I guess it was more controversial than you realized. If you have
other examples of other kinds of bugs or vulnerabilities, feel free to share
them. I suspect there are people who would be interested.

The aggregate effect of all
the deficiencies found was such as to undermine any confidence in
the security properties.

That's fine. But like I keep saying, there is an important difference
between "I found a security vulnerability" and "I found bugs that
undermine my confidence in its security properties". You wrote the
former, but apparently meant the latter. But the two are not equivalent.
If you found a honest-to-goodness exploitable security vulnerability,
there is usually no doubt that the implementation is insecure. With the
latter, it is a judgement call, and one has to judge how substantial
the risk is, how serious the bugs were, how much risk one is willing to
accept, how much confidence is needed, and whether there are any better
alternatives. I don't know why you insist on defending your initial
claim that you found security vulnerabilities, if the worst you found
is an unchecked malloc and potential null pointer dereference.
.

Relevant Pages

  • RE: Mac OS X no longer immune to viruses!
    ... VMS does notrely on security by obscurity. ... No vendor makes a platform that is 100% secure - heck, ... Are some platforms inherently more secure by design? ... Do the platforms that are more secure have the same market share as ...
    (comp.os.vms)
  • Re: Thou shalt have no other gods before the ANSI C standard
    ... Because of these two platforms ... > The C standard does allow memcpy of pointer objects. ... New compiler development for such platforms is not a poor economic ...
    (sci.crypt)
  • Re: Lille-Strasbourg TGV
    ... providing enough security for a nation that is at war. ... those boarding at Amsterdam to take place on the train. ... have a similar problem at Bruxelles where the secure platforms are north ...
    (uk.railway)
  • Re: I am REALLY Getting Tired of Probes on 445 and 135
    ... > marketshare does not mean more security problems. ... Both platforms have poorly designed software - you can see this by the ... The non-MS bases platforms are much less open to the MS types security ... proportional to the installed base. ...
    (comp.security.misc)
  • Re: Why does rewind() ignore errors?
    ... promise that memsetting any scalar to zero on their implementations ... YOU can assume that all-zero-bits is a valid null pointer ... platforms where it is true. ... The C standard allows C implementations to run programs on those rare ...
    (comp.std.c)