Menu
OpenSSL fixes serious flaw that could enable man-in-the-middle attacks

OpenSSL fixes serious flaw that could enable man-in-the-middle attacks

The vulnerability allows attackers to generate rogue certificates that pass OpenSSL's validation

Digital key

Digital key

A flaw in the widely used OpenSSL library could allow man-in-the-middle attackers to impersonate HTTPS servers and snoop on encrypted traffic. Most browsers are not affected, but other applications and embedded devices could be.

The OpenSSL 1.0.1p and 1.0.2d versions released Thursday fix an issue that could be used to bypass certain checks and trick OpenSSL to treat any valid certificates as belonging to certificate authorities. Attackers could exploit this to generate rogue certificates for any website that would be accepted by OpenSSL.

"This vulnerability is really only useful to an active attacker, who is already capable of performing a man-in-the-middle (MITM) attack, either locally or upstream from the victim," said Tod Beardsley, security engineering manager at Rapid7, via email. "This limits the feasibility of attacks to actors who are already in a privileged position on one of the hops between the client and the server, or is on the same LAN and can impersonate DNS or gateways."

The problem was introduced in OpenSSL versions 1.0.1n and 1.0.2b that were released on June 11 to fix five other security vulnerabilities. Developers and server administrators who did the right thing and updated their OpenSSL versions last month, should do so again immediately.

OpenSSL versions 1.0.1o and 1.0.2c that were released on June 12 are also affected.

"This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication," the OpenSSL Project said in a security advisory published Thursday.

An example of servers that validate client certificates for authentication are VPN servers.

Fortunately, the four major browsers are not impacted because they don't use OpenSSL for certificate validation. Mozilla Firefox, Apple Safari and Internet Explorer use their own crypto libraries and Google Chrome uses BoringSSL, a Google-maintained fork of OpenSSL. The BoringSSL developers actually discovered this new vulnerability and submitted the patch for it to OpenSSL.

The real-world impact is likely not very high. There are desktop and mobile applications that use OpenSSL to encrypt their Internet traffic, as well as servers and Internet-of-Things devices that use it to secure machine-to-machine communications.

But even so, their number is small compared to the number of Web browser installations and it's unlikely that many of them use a recent version of OpenSSL that is vulnerable, said Ivan Ristic, director of engineering at security vendor Qualys and creator of SSL Labs.

For example, the OpenSSL packages distributed with some Linux distributions, including Red Hat, Debian and Ubuntu are not affected. That's because Linux distributions typically backport security fixes into their packages instead of completely updating them to new versions.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags patch managementpatchesExploits / vulnerabilitiesRapid7OpenSSL Project

Featured

Slideshows

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomes industry figures for 2019 Hall of Fame lunch

Reseller News welcomed 2018 inductees - Chris Simpson, Kendra Ross and Phill Patton - to the third running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing landscape of the technology industry in New Zealand, while outlining ways to attract a new breed of players to the ecosystem. Photos by Gino Demeer.

Reseller News welcomes industry figures for 2019 Hall of Fame lunch
Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019

The channel came together for the inaugural Reseller News Emerging Leaders Forum in New Zealand, created to provide a program that identifies, educates and showcases the upcoming talent of the ICT industry. Hosted as a half day event, attendees heard from industry champions as keynoters and panelists talked about future opportunities and leadership paths and joined mentoring sessions with members of the ICT industry Hall of Fame. The forum concluded with 30 Under 30 Tech Awards across areas of Sales, Entrepreneur, Marketing, Management, Technical and Human Resources. Photos by Gino Demeer.

Upcoming tech talent share insights at inaugural Emerging Leaders Forum 2019
Show Comments