Pierluigi Paganini
April 08, 2014
Experts which provide maintenance to OpenSSL library have patched a serious vulnerability (CVE-2014-0160) that allows an attacker to gain the access to 64 KB of memory to any client or server that was connected.
“The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack,” reports the CVE record for the vulnerability.
The OpenSSL project is managed by a worldwide community of volunteers, which provides support OpenSSL library and related documentation. OpenSSL is the most popular open source cryptographic library and TLS implementation for traffic encryption.
“Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.”
The OpenSSL community hasn’t provided a detailed info on the fixed flaw, below an abstract from the release notes 1.0.1g:
“A missing bounds check in the handling of the TLS heartbeat extension can be used to reveal up to 64kB of memory to a connected client or server,” states the OpenSSL release notes for 1.0.1g.
The OpenSSL library is present in a wide variety of OSs as well as applications and most popular web servers including Nginx and Apache.
Which version of the OpenSSL are affected?
Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.
Security experts at Codenomicon prepared an interesting list of FAQ on the vulnerability, dubbed the Heartbleed flaw, which allows an attacker to remotely read the memory of a machine that runs a vulnerable version of the library.
“The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop communications, steal data directly from the services and users and to impersonate services and users,” is reported on an official FAQ page.
The flaw, which is considerable a programming mistake, also impacted cloud computing platforms including CloudFlare that already implemented its own fix for the OpenSSL vulnerability last week.
“OpenSSL is the core cryptographic library CloudFlare uses for SSL/TLS connections. If your site is on CloudFlare, every connection made to the HTTPS version of your site goes through this library. As one of the largest deployments of OpenSSL on the Internet today, CloudFlare has a responsibility to be vigilant about fixing these types of bugs before they go public and attackers start exploiting them and putting our customers at risk,” reported CloudFlare in official blog post.
It is crucial to upgrade every server using OpenSSL, the version 1.0.1g fix the flaw, previous versions of the library OpenSSL must be re-compiled with the OPENSSL_NO_HEARTBEATS flag solve the problem. Let me suggest you to see the following video realized by Zulfikar Ramzan, MIT Ph.D. and CTO of cloud security firm Elastica.
Numerous online services to implement it or TLS to encrypt traffic and transactions, the OpenSSL version 1.0.1g includes a fix for other kind of side-channel attacks.
Be aware, encryption notoriously id used to protect our privacy and sensitive data, this vulnerability could expose them!
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – OpenSSL, Heartbleed)
[adrotate banner=”5″]
[adrotate banner=”13″]
