back to article Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat

If you're using the popular OpenSSL open source cryptography library, you have more to worry about than the recently disclosed POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerability, project devs have warned. In addition to patching two POODLE-related bugs, new releases of OpenSSL issued on Wednesday also close …

  1. Anonymous Coward
    Anonymous Coward

    Thanks to...

    CVE-2014-3513 - Severity High - "This issue was reported to OpenSSL on 26th September 2014, based on an original issue and patch developed by the LibreSSL project."

    CVE-2014-3567 - Severity: Medium - "This issue was reported to OpenSSL on 8th October 2014. The fix was developed by Stephen Henson of the OpenSSL core team."

    CVE-2014-3566 - Severity: Medium - "Support for TLS_FALLBACK_SCSV was developed by Adam Langley and Bodo Moeller."

    CVE-2014-3568 - Severity: Low - "This issue was reported to OpenSSL by Akamai Technologies on 14th October 2014. The fix was developed by Akamai and the OpenSSL team."

    --> https://www.openssl.org/news/secadv_20141015.txt

  2. Anonymous Coward
    Anonymous Coward

    heck, the way things are going

    Even I could find a bug

    1. Anonymous Coward
      Meh

      Re: heck, the way things are going

      Was just thinking that, there seem to have been a lot of high risk bugs recently. Part of me thinks that's great because it probably stems from more eyes on the code, but I do worry that there are so many to find

      1. stephanh Silver badge

        Re: heck, the way things are going

        Industry average for "good quality" software: 1 defect per 1000 lines of code. Source: http://www.net-security.org/secworld.php?id=14871

        OpenSSL source code: approx. 500,000 lines of code.

        So four down, 496 bugs to go. And that is assuming the people adding "features" aren't putting them back in faster than they can be found.

  3. Anonymous Coward
    Anonymous Coward

    I wonder

    How many of these were genuine mistakes versus how many were plants by the NSA & Co

    I'll get my coat, Tinfoil please.

    1. Michael Wojcik Silver badge

      Re: I wonder

      It would require a tremendous stretch to believe any of these were plants. One (support for TLS_FALLBACK_SCSV) is in fact a new feature; it isn't a "fix" by any definition. Of the other three, two are DoS issues, which are of very low value to the SIGINT community.

      The last could have some SIGINT utility, since getting a product to downgrade to SSLv3 leaves it open to decryption attacks like POODLE and BEAST (when using a block cipher) or RC4 bias exploitation. But few OpenSSL installations use a version built with --no-ssl3, so on the whole it'd be a very low-value attack. If a SIGINT agency had an opportunity to sneak a flaw into the OpenSSL sources, they could do much better.

  4. Paul D Smyth

    Debian Security Announcement

    Is it absolutely impossible for these guys to just send out an announcement in plain English?

    A memory leak flaw was found in the way an OpenSSL handled failed

    session ticket integrity checks. A remote attacker could exhaust all

    available memory of an SSL/TLS or DTLS server by sending a large number

    of invalid session tickets to that server.

    What? Where, what typical applications/scenarios might be affected? Real world examples? No wonder the Open Source world has such a bad rep amongst non geeks. Pure gobbledygook brought on by severe laziness and extreme arrogance.

    1. khurtwilliams

      Re: Debian Security Announcement

      Let's be honest. If you don't know what the advisory means then you aren't the intended audience.

    2. Down not across Silver badge

      Re: Debian Security Announcement

      Is it absolutely impossible for these guys to just send out an announcement in plain English?

      A memory leak flaw was found in the way an OpenSSL handled failed

      session ticket integrity checks. A remote attacker could exhaust all

      available memory of an SSL/TLS or DTLS server by sending a large number

      of invalid session tickets to that server.

      What? Where, what typical applications/scenarios might be affected? Real world examples? No wonder the Open Source world has such a bad rep amongst non geeks. Pure gobbledygook brought on by severe laziness and extreme arrogance.

      That's pretty plain english for an announcement on crypto library.They clearly state the issue is in session handling and that can be used to exhaust memory. Don't really see how it could be any clearer.

      There are so many applications using OpenSSL that listing them would not be practical. I doubt OpenSSL team even know all the applications that may use the libraries.

      The announcement is obviously intended to somewhat technical audience. It would be up to your sysadmin (in corporate environment) to disseminate information as to what, within your organisation, is affected and how.

      Would you think of the same of a technical bulletin issued by car manufacturer, when it is really intended for mechanics rather than end users?

      I'm sorry but it appears the laziness and arrogance is on your part for assuming the technical announcement from developers would be watered down to be suitable for you.

  5. khurtwilliams

    Session Ticket Memory Leak (CVE-2014-3567)

    The current patch already includes a fix for Session Ticket Memory Leak (CVE-2014-3567)

    https://www.openssl.org/news/secadv_20141015.txt

  6. Daggerchild Silver badge
    Stop

    Version 0.9.8 z c (beta, RC-2, final, ...)

    Public Advisory: Teach your children about library version numbering schemes, or they too could end up like this.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019