Pierluigi Paganini
July 10, 2015
OpenSSL Foundation has issued a security update as announced weeks ago. The patch just released fixes a mysterious security flaw affecting the OpenSSL code library, in the last weeks, the details of the vulnerability weren’t disclosed by the OpenSSL Foundation due to its severity.
The high severity vulnerability affects OpenSSL versions 1.0.1n and 1.0.2b, it is a resolving a certificate forgery issue (CVE-2015-1793) and its exploitation could attackers to run man-in-the-middle attacks. The attackers could exploit the flaw to impersonate websites implementing HTTPs, or to run MITM attacks on VPNs and eavesdrop encrypted traffic.
“During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and “issue” an invalid certificate. ” states the advisory by OpenSSL.
The flaw has a severe impact on any application that relies on digital certificates to validate user’s identity. Transport Layer Security (TLS) or Secure Sockets Layer (SSL) or DTLS clients and SSL/TLS/DTLS servers using client authentication are affected by the vulnerability.
The OpenSSL Foundation urges:
(Security Affairs – OpenSSL, hacking)
