Two high severity vulnerabilities released for OpenSSL
Bronnen
- https://www.openssl.org/news/vulnerabilities.html
- https://mta.openssl.org/pipermail/openssl-announce/2022-November/000243.html
- https://www.openssl.org/blog/blog/2022/11/01/email-address-overflows/
Risico’s
OpenSSL released a security update on November 1, 2022, for OpenSSLv3 fixing two high severity vulnerabilities: CVE-2022-3786 and CVE-2022-3602. Both vulnerabilities concern buffer overruns which can be triggered in X.509 certificate verification.
CVE-2022-3602 is an arbitrary 4-byte stack buffer overflow that could trigger crashes or lead to remote code execution (RCE), while CVE-2022-3786 can be exploited by attackers via malicious email addresses to trigger a denial-of-service state (DoS) via a buffer overflow.
Pre-announcements of CVE-2022-3602 described this issue as CRITICAL. Further analysis has led this to be downgraded to HIGH.
Exploitation of these vulnerabilities could result in a crash causing a Denial of Service (DoS). CVE-2022-3602 could theoretically also lead to remote code execution (RCE).
OpenSSL is not aware of any working exploit that could lead to remote code execution and has no evidence of these issues being exploited as of the time of release of this post.
Beschrijving
The update patches buffer overrun vulnerabilities which happen during X.509 certificate verification, specifically in name constraint checking. Note name constraint checking is only triggered after the certificate chain is verified. An attacker thus first needs to be able to have a malicious certificate signed by a certificate authority the client trusts. This significantly increases attack complexity.
For CVE-2022-3786 the attacker needs to craft a malicious email address in the certificate to overflow an arbitrary number of bytes containing the `.' character (decimal 46) on the stack. This buffer overflow could result in a crash causing a denial of service (DoS).
For CVE-2022-3602 an attacker can craft a malicious email address to overflow four attacker-controlled bytes on the stack. This buffer overflow could result in a crash (causing a denial of service) or potentially remote code execution. Many platforms implement stack overflow protections which would mitigate against the risk of remote code execution.
Affected products
OpenSSL versions starting from v3.0.0 until and including v3.0.6.
Aanbevolen acties
Users operating TLS servers may consider disabling TLS client authentication, if it is being used, until fixes are applied.
Although this does not concern a critical vulnerability, the CCB still recommends system administrators to patch vulnerable systems. It is worth updating quickly, but many sites do not appear to be at immediate risk.
In case of an intrusion, you can report an incident via: https://cert.be/en/report-incident.