[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
UNIRAS ALERT - 28/03 - Vulnerability Issues in Implementations of the TLS and SSL Protocols
-----BEGIN PGP SIGNED MESSAGE-----
- ----------------------------------------------------------------------------------
UNIRAS (UK Govt CERT) ALERT - 28/03 dated 30.09.03 Time: 13:00
UNIRAS is part of NISCC(National Infrastructure Security Co-ordination Centre)
- ----------------------------------------------------------------------------------
UNIRAS material is also available from its website at www.uniras.gov.uk and
Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------
Title
=====
NISCC Vulnerability Advisory - 006489/TLS:
Vulnerability Issues in Implementations of the TLS and SSL Protocols
Detail
======
Version Information
- -------------------
Advisory Reference 006489/TLS
Release Date 30 September 2003
Last Revision 30 September 2003
Version Number 1.0
What is affected?
- -----------------
The vulnerabilities described in this advisory affect the TLS and SSL protocols,
which are typically used to provide security services to a range of Internet
application protocols and in support of web and email applications.
Many vendors include support for TLS/SSL in their products.
Severity
- --------
The severity of these vulnerabilities varies by vendor. In some cases, they
could allow an attacker to create a Denial of Service condition. It may be
possible for an attacker to execute code as a result of a buffer overflow, but
this has not been demonstrated.
TLS/SSL client applications may be harder to attack than server applications,
since a client must first be directed to a hostile site before exploitation can
occur.
Summary
- -------
During 2002 the University of Oulu Security Programming Group (OUSPG) discovered
a number of implementation specific vulnerabilities in the Simple Network
Management Protocol (SNMP). NISCC has performed and commissioned further work
to identify implementation specific vulnerabilities in related protocols that
are critical to the UK Critical National Infrastructure. The TLS (transport
layer security) and SSL (secure sockets layer) protocols, which add
communications protection to a range of Internet protocols have been studied in
this context.
NISCC has produced a test suite for TLS/SSL and has employed it to validate a
number of products from different vendors. The test results have been
confirmed, and the affected vendors have been contacted with the test results.
These vendors' product lines cover a great deal of the existing critical
information infrastructure worldwide and have therefore been addressed as a
priority. However, NISCC has subsequently contacted other vendors whose
products employ TLS/SSL and provided them with tools with which to test their
implementations.
Details
- -------
TLS and SSL are intermediate protocols layered onto a TCP connection used to
provide additional security to higher level protocols. Higher level protocols,
particularly application protocols such as web services or email, may be layered
on top of a TLS/SSL connection.
TLS is based on SSL 3.0, and although the two are not interoperable,
implementations of TLS 1.0 are likely to support SSL 3.0. For the purpose of
this discussion the two will be considered equivalent. TLS and SSL are not
Abstract Syntax Notation One based protocols, and define their own presentation
language as part of the TLS/SSL specification. However, they do depend on a
number of ASN.1 objects used as part of the protocol exchange.
If one of the parties involved in a TLS/SSL connection sends an ASN.1 element
that cannot be handled properly, the behaviour of the receiving application may
be unpredictable. For example, it has been found that a vulnerability can arise
where one of the parties generates an exceptional ASN.1 element as part of a
client certificate. A Denial of Service may arise in the receiving application,
or there may be an opportunity for further exploitation.
Vendor specific information will be released as it becomes available, but information
will only be released with vendors permission. Subscribers are advised to check the
following URL regularly for updates:
http://www.uniras.gov.uk/vuls/2003/006489/tls.htm
[Please note that revisions to this advisory will not be notified by email.]
Solution
- --------
Please refer to the Vendor Information section of this advisory for platform
specific remediation.
Vendor Information
- ------------------
A list of vendors affected by this vulnerability is not currently available.
Please visit the web site, http://www.uniras.gov.uk/vuls/2003/006489/tls.htm,
in order to check for updates.
Contact Information
- -------------------
The NISCC Vulnerability Management Team can be contacted as follows:
Email vulteam@xxxxxxxxxxxx
Please quote the advisory reference in the subject line.
Telephone +44 (0) 20 7821 1330 Ext 4511
Monday - Friday 08:30 - 17:00 hrs
Fax +44 (0) 20 7821 1686
Post Vulnerability Management Team
NISCC
PO Box 832
London
SW1P 1BG
We encourage those who wish to communicate via email to make use of our PGP key.
This is available from
http://www.uniras.gov.uk/UNIRAS.asc
Please note that UK government protectively marked material should not be sent
to the email address above.
If you wish to be added to our email distribution list please email your request
to uniras@xxxxxxxxxxxxx
What is NISCC?
- --------------
For further information regarding the UK National Infrastructure Security
Co-ordination Centre, please visit
http://www.niscc.gov.uk/aboutniscc/index.htm.
Reference to any specific commercial product, process, or service by trade name,
trademark manufacturer, or otherwise, does not constitute or imply its
endorsement, recommendation, or favouring by NISCC. The views and opinions of
authors expressed within this notice shall not be used for advertising or
product endorsement purposes.
Neither shall NISCC accept responsibility for any errors or omissions contained
within this briefing notice. In particular, they shall not be liable for any
loss or damage whatsoever, arising from or in connection with the usage of
information contained within this notice.
(C) 2003 Crown Copyright
<End of NISCC Vulnerability Advisory>
- ----------------------------------------------------------------------------------
For additional information or assistance, please contact the HELP Desk by
telephone or Not Protectively Marked information may be sent via EMail to:
uniras@xxxxxxxxxxxx
Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 20 7821 1330 Ext 4511
Fax: +44 (0) 20 7821 1686
Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 20 7821 1330 and follow the prompts
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some
of the information may have changed since it was released. If the vulnerability
affects you, it may be prudent to retrieve the advisory from the canonical site
to ensure that you receive the most current information concerning that problem.
Reference to any specific commercial product, process, or service by trade
name, trademark manufacturer, or otherwise, does not constitute or imply
its endorsement, recommendation, or favouring by UNIRAS or NISCC. The views
and opinions of authors expressed within this notice shall not be used for
advertising or product endorsement purposes.
Neither UNIRAS or NISCC shall also accept responsibility for any errors
or omissions contained within this briefing notice. In particular, they shall
not be liable for any loss or damage whatsoever, arising from or in connection
with the usage of information contained within this notice.
UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST)
and has contacts with other international Incident Response Teams (IRTs) in
order to foster cooperation and coordination in incident prevention, to prompt
rapid reaction to incidents, and to promote information sharing amongst its
members and the community at large.
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQCVAwUBP3lntYpao72zK539AQFHUAQArG+ANfQy9eeM2xAYUV98LqGM774Ic4ky
g32FRIFxeNPQ0i4MocKCHicPtJ9obm/DyrYWk4rEgL6hFmbxbduGjJqFtp+T6Mow
XxAQmiqr7jRhnis6jq2qhiqw9ezhZUKJriQMiGdUDC0PI38aV/qknIA8Vf/Ygzvk
ALPkl/bWOxk=
=bubP
-----END PGP SIGNATURE-----