Menu
OpenSSL fixes serious flaw that could enable man-in-the-middle attacks

OpenSSL fixes serious flaw that could enable man-in-the-middle attacks

The vulnerability allows attackers to generate rogue certificates that pass OpenSSL's validation

Digital key

Digital key

A flaw in the widely used OpenSSL library could allow man-in-the-middle attackers to impersonate HTTPS servers and snoop on encrypted traffic. Most browsers are not affected, but other applications and embedded devices could be.

The OpenSSL 1.0.1p and 1.0.2d versions released Thursday fix an issue that could be used to bypass certain checks and trick OpenSSL to treat any valid certificates as belonging to certificate authorities. Attackers could exploit this to generate rogue certificates for any website that would be accepted by OpenSSL.

"This vulnerability is really only useful to an active attacker, who is already capable of performing a man-in-the-middle (MITM) attack, either locally or upstream from the victim," said Tod Beardsley, security engineering manager at Rapid7, via email. "This limits the feasibility of attacks to actors who are already in a privileged position on one of the hops between the client and the server, or is on the same LAN and can impersonate DNS or gateways."

The problem was introduced in OpenSSL versions 1.0.1n and 1.0.2b that were released on June 11 to fix five other security vulnerabilities. Developers and server administrators who did the right thing and updated their OpenSSL versions last month, should do so again immediately.

OpenSSL versions 1.0.1o and 1.0.2c that were released on June 12 are also affected.

"This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication," the OpenSSL Project said in a security advisory published Thursday.

An example of servers that validate client certificates for authentication are VPN servers.

Fortunately, the four major browsers are not impacted because they don't use OpenSSL for certificate validation. Mozilla Firefox, Apple Safari and Internet Explorer use their own crypto libraries and Google Chrome uses BoringSSL, a Google-maintained fork of OpenSSL. The BoringSSL developers actually discovered this new vulnerability and submitted the patch for it to OpenSSL.

The real-world impact is likely not very high. There are desktop and mobile applications that use OpenSSL to encrypt their Internet traffic, as well as servers and Internet-of-Things devices that use it to secure machine-to-machine communications.

But even so, their number is small compared to the number of Web browser installations and it's unlikely that many of them use a recent version of OpenSSL that is vulnerable, said Ivan Ristic, director of engineering at security vendor Qualys and creator of SSL Labs.

For example, the OpenSSL packages distributed with some Linux distributions, including Red Hat, Debian and Ubuntu are not affected. That's because Linux distributions typically backport security fixes into their packages instead of completely updating them to new versions.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitypatch managementencryptionpatchesExploits / vulnerabilitiesRapid7OpenSSL Project

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments