Remember the Heartbleed scare which had you scurrying to change your passwords and worrying about online privacy a few weeks ago? How could you forget it…
After all, hundreds of thousands of websites were impacted by that flaw, as well as millions of Android devices put at risk.
Well, it looks like that wasn’t the last word in security issues with OpenSSL.
The OpenSSL team has released a new security advisory, detailing six further vulnerabilities in the open source cryptographic library which is widely used across the net.
The bad news is that the vulnerabilities are serious, and could allow a man-in-the-middle (MITM) snooping on encrypted connections, or to run malicious code on vulnerable systems.
The good news is that patches are already available for the newly-discovered bugs, and that it appears to be harder to exploit these vulnerabilities than the Heartbleed bug.
Questions will no doubt be asked as to how some of these vulnerabilities remained undetected in the open source software for more than 10 years, without being noticed.
OpenSSL is open source, meaning that anyone can review the code and fix it if they want. Normally that’s a reason for people to consider code more secure or trustworthy – but what use is it if no-one is properly checking the code for vulnerabilities?
When considering the latest vulnerabilities, most people will probably be concerned about the MITM attack, dubbed CVE-2014-0224, which was discovered by Japanese security researcher Masashi Kikuchi.
SSL/TLS MITM vulnerability (CVE-2014-0224)
An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server.
The attack can only be performed between a vulnerable client *and* server. OpenSSL clients are vulnerable in all versions of OpenSSL. Servers are only known to be vulnerable in OpenSSL 1.0.1 and 1.0.2-beta1. Users of OpenSSL servers earlier than 1.0.1 are advised to upgrade as a precaution.
OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to 0.9.8za.
OpenSSL 1.0.0 SSL/TLS users (client and/or server) should upgrade to 1.0.0m.
OpenSSL 1.0.1 SSL/TLS users (client and/or server) should upgrade to 1.0.1h.Thanks to KIKUCHI Masashi (Lepidum Co. Ltd.) for discovering and researching this issue. This issue was reported to OpenSSL on 1st May 2014 via JPCERT/CC.
To be exploited, the CVE-2014-0224 vulnerability (there’s no super-sexy name or logo like Heartbleed this time) requires software at both the client’s end and the server to be running at-risk versions of OpenSSL. The most likely opportunity for a hacker might be if you were accessing the internet at a public wifi hotspot, without using a VPN.
Fortunately, popular web browsers like Internet Explorer, Firefox, Chrome and Safari don’t use OpenSSL – which dramatically reduces the risk.
Nonetheless, any software which uses OpenSSL should be updated. Don’t be surprised to see security updates for your smartphone and desktop applications that might use OpenSSL begin to roll out in the coming days.
For more information, read the OpenSSL security advisory.
This article originally appeared on the Lumension blog.
