OpenSSL Hit By Another Major Vulnerability

GoodBytes · June 6, 2014

OpenSSL has just starting to recover from Hearbleed security issue, and another major vulnerability was found, however this new weakness is harder to exploit than heartbleed.

The good news of the vulnerability is that it is fixed, with 7 others, however it is important to apply the update of OpenSSL.

Rapid7 reports:

The OpenSSL project published a security advisory containing several vulnerabilities. The most discussed vulnerability is CVE-2014-0224, through which an eavesdropper can reduce the strength of the encryption through a Man-in-the-Middle (MITM) attack, putting the content of the transmitted data at risk. However, there are other vulnerabilities in the advisory that could be used for denial of service (DoS) attacks or remote code execution.

[...]

These are significant threats, although harder to exploit than the recent Heartbleed vulnerabilities in OpenSSL.

The newly disclosed MITM vulnerability (CVE-2014-0224) affects all OpenSSL clients and devices that communicate with vulnerable servers. While all OpenSSL client versions are vulnerable, only the most recent OpenSSL server versions are affected. In order for the vulnerability to be exploited, both the client and the server must be vulnerable.

A MITM attack is dangerous because it can allow an attacker to intercept data that was presumed encrypted between a client (e.g., an end user) and a server (e.g., the online bank). This attack is passive in nature and may not be detected by client, server or network based security controls.

The second vulnerability (CVE-2014-0221) is likely only a Denial of Service (DoS) attack that would not expose encrypted data. Rapid7 rates it as a low threat generally, high for critical services.

One vulnerability that has surprisingly been discussed very little is the DTLS invalid fragment vulnerability (CVE-2014-0195), which contains a buffer overrun that could be exploitable with arbitrary code execution. Rapid7 is conducting further research and will update the community if additional information becomes available. Rapid7 rates this as a medium to high threat, and one to keep on your watch list.

The person that discovered it is Masashi Kikuchi, security advisor on his blog.

(read more: http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html)

Sources:

http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html

https://community.rapid7.com/community/infosec/blog/2014/06/05/ccs-injection-vulnerability-severe-vulnerability-shows-we-re-not-done-with-openssl-just-yet

http://globalnews.ca/news/1376273/severe-vulnerability-found-in-openssl-just-months-after-heartbleed/