-----BEGIN PGP SIGNED MESSAGE-----
__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
Advisory Bulletin
Vulnerability in Some Implementations of PKCS#1
June 26, 1998 13:30 GMT Number AI-003
______________________________________________________________________________
PROBLEM: A vulnerability exists in some versions of RSA Laboratories'
Public-Key Cryptography Standard #1 (PKCS#1) that allows a
sophisticated intruder to recover information from
SSL-encrypted (encrypted web) sessions.
PLATFORM: All platforms that use PKDS#1 encryption such as web
browsers and servers that implement encrypted (SSL) sessions.
DAMAGE: If exploited, a sophisticated intruder could obtain a session
key and read an encrypted session.
SOLUTION: Apply the patches described in the bulletin. Obtain updated
products from your software vendors.
______________________________________________________________________________
VULNERABILITY Exploiting this vulnerability takes a sophisticated intruder
ASSESSMENT: who is able to observe a SSL encrypted session and who can
repeatedly interrogate the web server. However SSL is widely
used to protect sensitive and financial web transactions.
______________________________________________________________________________
[ Start CERT Advisory CA-98.07 ]
=============================================================================
CERT* Advisory CA-98.07
Original issue date: June 26, 1998
Topic: Vulnerability in Some Usages of PKCS#1
- ------------------------------------------------------------------------------
The CERT Coordination Center has received a report regarding a vulnerability
in some implementations of products utilizing RSA Laboratories' Public-Key
Cryptography Standard #1 (PKCS#1). Under some situations, a sophisticated
intruder may be able to use the vulnerability in PKCS#1 to recover
information from SSL-encrypted sessions.
The CERT/CC team recommends that sites install patches immediately as
described in Appendix A. Appendix A also contains pointers to web pages
containing additional information maintained by some vendors.
We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.
- ------------------------------------------------------------------------------
I. Description
PKCS#1 is a standard for encrypting data using the RSA public-key
cryptosystem. Its intended use is in the construction of digital
signatures and digital envelopes.
One use for the digital envelopes constructed using PKCS#1 is to provide
confidentiality during the session key negotiation of an SSL-encrypted
session. The SSL protocol is widely used to encrypt traffic to and from
web servers to protect the privacy of information such as personal data
or a credit card number, as it traverses the internet. A sophisticated
intruder may be able to use the vulnerability in PKCS#1 to recover
information from an SSL-encrypted session.
Web pages employing SSL are accessed using the HTTPS protocol, rather
than the HTTP protocol.
More information about PKCS#1 can be found at
http://www.rsa.com/rsalabs/pubs/PKCS/
Additional information regarding this vulnerability will be
available at
http://www.bell-labs.com
This vulnerability does not affect all PKCS#1-enabled products. The
attack is not effective against protocols in which there is not an
interactive session setup, or where the error messages returned by the
server do not distinguish among the types of failures. In particular,
this vulnerability does not affect S/MIME or SET.
II. Impact
Under some circumstances, an intruder who is able to observe an
SSL-encrypted session, and subsequently interrogate the server involved
in the session, may be able to recover the session key used in that
session, and then recover the encrypted data from that session.
The vulnerability can only be exploited if the intruder is able to make
repeated session-establishment attempts to the same vulnerable web server
which was involved in the original session. In addition, the server must
return error messages that distinguish between several modes of
failure. Although the number of session-establishment requests is large,
it is significantly more efficient than a brute-force attack against the
session key. Note that, although web servers comprise the majority of
vulnerable servers, other PKCS#1-enabled servers may be vulnerable.
Note that the server's public and private key are not at risk from this
vulnerability, and that an intruder is only able to recover data from a
single session per attack. Compromising a single session does not give an
intruder any additional ability to compromise subsequent sessions.
Further, as mentioned above, this vulnerability does not affect all
PKCS#1-enabled products.
III. Solution
A. Obtain and install a patch for this problem.
Appendix A contains input from vendors who have provided information
for this advisory. We will update the appendix as we receive more
information. If you do not see your vendor's name, the CERT/CC did
not hear from that vendor. Please contact your vendor directly.
B. Although applying vendor patches is the recommended course of action,
you may wish to consider some of the following steps to reduce your
exposure to this vulnerability:
-- Examine your log files for repeated error messages indicating
failed requests for session-establishment. For example, sites using
C2Net's Stronghold server would see error messages of the form
[Tue Jun 23 22:08:17 1998] SSL accept error
1575:error:0407006B:rsa routines:RSA_padding_check_PKCS1_type_2:block type is
not 02:rsa_pk1.c:207
1575:error:04064072:rsa routines:RSA_EAY_PRIVATE_DECRYPT:padding check
failed:rsa_eay.c:330
1575:error:1408B076:SSL routines:SSL3_GET_CLIENT_KEY_EXCHANGE:bad rsa
decrypt:s3_srvr.c:1259
-- If you are unable to upgrade for an extended period of time, you
may wish to consider obtaining a new public/private key pair for
servers. Changing the key pair only protects those sessions which may
have been previously recorded by an intruder. This does not prevent
an intruder from launching attacks against newly-recorded
sessions. This should only be considered in those cases where
upgrading is infeasible. Again, note that the public/private key pair
is not at risk from this vulnerability.
-- Avoid using the same public/private key pair across multiple
servers.
-- A large increase in CPU utilization or network traffic may
accompany an attack. If your web server does not provide sufficient
detail in its logs to detect failures, you may wish to look for
substantial deviation from established usage patterns, which may be
indicative of an attack.
Implementors and researchers should consult RSA Laboratories Bulletin
Number 7 for additional measures to reduce the effectiveness of this
attack. This document will be available at
http://www.rsa.com/rsalabs/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Appendix A - Vendor Information
Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.
C2Net Software, Inc.
-------------------
C2Net has developed a patch and is deploying new builds to combat this
problem. More information is available at
http://www.c2.net
Microsoft Corporation
---------------------
The Microsoft Product Security Response Team has produced an update
for the following affected Microsoft Internet server software:
- Microsoft Internet Information Server 3.0 and 4.0
- Microsoft Site Server 3.0, Commerce Edition
- Microsoft Site Server, Enterprise Edition
- Microsoft Exchange 5.0 and 5.5 (for SSL-enabled POP3 and SMTP)
Microsoft's Internet server software provides SSL 2.0, SSL 3.0, PCT
1.0, and TLS 1.0 for securing Internet-based communications. These
protocols are all implemented in a single file called SCHANNEL.DLL,
which is shared by the Microsoft Internet server software listed
above. Updating this single file will resolve this vulnerability for
these Microsoft server products.
No updates are required for Internet client software, such as Internet
Explorer.
This update is now available. Microsoft strongly recommends that
customers using secure SSL Internet services with any of the Microsoft
products listed above should update to the latest version of
SCHANNEL.DLL.
Please visit the Microsoft Security Advisor web site for more
information, or link directly to our Microsoft security
bulletin MS98-002 at
http://www.microsoft.com/security/bulletins/ms98-002.htm
Netscape Communications Corporation
-----------------------------------
Netscape recommends that all customers running Netscape Enterprise
Server software, Netscape Proxy Server, Netscape Messaging Server and
Netscape Collabra Server download and install a simple patch before an
attack ever happens.
Product updates and full information about the countermeasures are
available immediately from the Netscape Internet site at:
http://help.netscape.com/products/server/ssldiscovery/index.html
Open Market, Inc.
-----------------
Some of Open Market's products are affected by this
vulnerability. Patches are available. For more information, go to
http://www.openmarket.com/security
RSA Data Security, Inc.
-----------------------
Information from RSA regarding this vulnerability is available at
http://www.rsa.com/rsalabs/
SSLeay
------
Information and SSLeay source patches related to this vulnerability
are available at:
http://www.ssleay.org/announce/
- ------------------------------------------------------------------------------
This vulnerability was originally discovered by Daniel Bleichenbacher of the
Secure Systems Research Department of Bell Labs, the research and development
arm of Lucent Technologies.
The CERT Coordination Center thanks Scott Schnell of RSA and Jason Garms of
Microsoft for reporting this problem to us and providing technical advice and
other valuable input into the construction of this advisory. In addition, our
thanks goes to Simona Nass, Douglas Barnes, and Tim Hudson of C2Net and David
Wagner of the University of California at Berkeley for the example log files
contained herein as well as additional technical advice and clarification
during the production of this advisory.
- ------------------------------------------------------------------------------
If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see http://www.first.org/team-info/).
CERT/CC Contact Information
- -----------------------------
Email cert@cert.org
Phone +1 412-268-7090 (24-hour hotline)
CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
and are on call for emergencies during other hours.
Fax +1 412-268-6989
Postal address
CERT Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh PA 15213-3890
USA
Using encryption
We strongly urge you to encrypt sensitive information sent by email. We can
support a shared DES key or PGP. Contact the CERT/CC for more information.
Location of CERT PGP key
ftp://ftp.cert.org/pub/CERT_PGP.key
Getting security information
CERT publications and other security information are available from
http://www.cert.org/
ftp://ftp.cert.org/pub/
CERT advisories and bulletins are also posted on the USENET newsgroup
comp.security.announce
To be added to our mailing list for advisories and bulletins, send
email to
cert-advisory-request@cert.org
In the subject line, type
SUBSCRIBE your-email-address
- ----------------------------------------------------------------------------
Copyright 1998 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff/legal_stuff.html and
ftp://ftp.cert.org/pub/legal_stuff .
If you do not have FTP or web access, send mail to cert@cert.org with
"copyright" in the subject line.
*CERT is registered in the U.S. Patent and Trademark Office.
- ----------------------------------------------------------------------------
This file: ftp://ftp.cert.org/pub/cert_advisories/CA-98.07.PKCS
http://www.cert.org/nav/alerts.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history
====================================================================
[ End CERT Advisory CA-98.07 ]
_____________________________________________________________________________
CIAC wishes to acknowledge the contributions of the CERT/CC, and Bell Labs
for the information contained in this bulletin.
_____________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@llnl.gov
For emergencies and off-hour assistance, DOE, DOE contractor sites,
and the NIH may contact CIAC 24-hours a day. During off hours (5PM -
8AM PST), call the CIAC voice number 925-422-8193 and leave a message,
or call 800-759-7243 (800-SKY-PAGE) to send a Sky Page. CIAC has two
Sky Page PIN numbers, the primary PIN number, 8550070, is for the CIAC
duty person, and the secondary PIN number, 8550074 is for the CIAC
Project Leader.
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
(or http://ciac.llnl.gov -- they're the same machine)
Anonymous FTP: ftp.ciac.org
(or ciac.llnl.gov -- they're the same machine)
Modem access: +1 (925) 423-4753 (28.8K baud)
+1 (925) 423-3331 (28.8K baud)
CIAC has several self-subscribing mailing lists for electronic
publications:
1. CIAC-BULLETIN for Advisories, highest priority - time critical
information and Bulletins, important computer security information;
2. SPI-ANNOUNCE for official news about Security Profile Inspector
(SPI) software updates, new features, distribution and
availability;
3. SPI-NOTES, for discussion of problems and solutions regarding the
use of SPI products.
Our mailing lists are managed by a public domain software package
called Majordomo, which ignores E-mail header subject lines. To
subscribe (add yourself) to one of our mailing lists, send the
following request as the E-mail message body, substituting
ciac-bulletin, spi-announce OR spi-notes for list-name:
E-mail to ciac-listproc@llnl.gov or majordomo@tholia.llnl.gov:
subscribe list-name
e.g., subscribe ciac-bulletin
You will receive an acknowledgment email immediately with a confirmation
that you will need to mail back to the addresses above, as per the
instructions in the email. This is a partial protection to make sure
you are really the one who asked to be signed up for the list in question.
If you include the word 'help' in the body of an email to the above address,
it will also send back an information file on how to subscribe/unsubscribe,
get past issues of CIAC bulletins via email, etc.
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
I-056: Cisco PIX Private Link Key Processing and Cryptography Vulnerabilities
I-057: FreeBSD NFS Kernel Code Error
I-058: SunOS rpc.nisd Vulnerability
I-059: SUN ftpd Vulnerability
I-060: SGI IRIX OSF/DCE Denial of Service Vulnerability
I-061: SGI IRIX mediad(1M) Vulnerability
I-062: SGI IRIX BIND DNS named(1M) Vulnerability
I-063: RSI BSDI rlogind Vulnerability
I-064: SGI IRIX mail(1), rmail(1M), sendmail(1M) Vulnerabilities
I-065: SunOS ufsrestore Buffer Overflow Vulnerability
-----BEGIN PGP SIGNATURE-----
Version: 4.0 Business Edition
iQCVAwUBNZOPrbnzJzdsy3QZAQFbDgQAzfVGs/oaStlig5pAtrTxZ88BQ61TRqA4
OibuvwANiDR/lJU1zZpVsOP7Vmmmb3zcqBPyXQzK6POj3hKGBnIvKH6iU6CRSwSc
QC/hcuRLgb+tc+OTj332O9h2WN21fvLsUPBEMytljplV+Dwtn0PgvSaaZbUPLTJ4
Gt/RK5ZjzhM=
=+hqr
-----END PGP SIGNATURE-----
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2025 AOH
