[Midnightbsd-cvs] src: /src: openssl security fix
laffer1 at midnightbsd.org
laffer1 at midnightbsd.org
Sat Jan 10 18:19:49 EST 2009
Log Message:
-----------
openssl security fix
Tags:
----
RELENG_0_2
Modified Files:
--------------
src:
UPDATING (r1.38.2.12 -> r1.38.2.13)
src/crypto/openssl/apps:
speed.c (r1.1.1.1 -> r1.1.1.1.4.1)
spkac.c (r1.1.1.1 -> r1.1.1.1.4.1)
verify.c (r1.1.1.1 -> r1.1.1.1.4.1)
x509.c (r1.1.1.1 -> r1.1.1.1.4.1)
src/crypto/openssl/ssl:
s2_clnt.c (r1.2 -> r1.2.4.1)
s2_srvr.c (r1.1.1.1 -> r1.1.1.1.4.1)
s3_clnt.c (r1.1.1.1 -> r1.1.1.1.4.1)
s3_srvr.c (r1.2 -> r1.2.4.1)
src/sys/conf:
newvers.sh (r1.3.2.7 -> r1.3.2.8)
-------------- next part --------------
Index: UPDATING
===================================================================
RCS file: /home/cvs/src/UPDATING,v
retrieving revision 1.38.2.12
retrieving revision 1.38.2.13
diff -L UPDATING -L UPDATING -u -r1.38.2.12 -r1.38.2.13
--- UPDATING
+++ UPDATING
@@ -3,6 +3,16 @@
Items affecting the mports and packages system can be found in
/usr/mports/UPDATING.
+20090110:
+ MidnightBSD 0.2.1-RELEASE-p5
+
+ For applications using OpenSSL for SSL connections, an invalid SSL
+ certificate may be interpreted as valid. This could for example be
+ used by an attacker to perform a man-in-the-middle attack.
+
+ Other applications which use the OpenSSL EVP API may similarly be
+ affected.
+
20081231:
MidnightBSD 0.2.1-RELEASE-p4
Index: speed.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/apps/speed.c,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.4.1
diff -L crypto/openssl/apps/speed.c -L crypto/openssl/apps/speed.c -u -r1.1.1.1 -r1.1.1.1.4.1
--- crypto/openssl/apps/speed.c
+++ crypto/openssl/apps/speed.c
@@ -1486,7 +1486,7 @@
{
ret=RSA_verify(NID_md5_sha1, buf,36, buf2,
rsa_num, rsa_key[j]);
- if (ret == 0)
+ if (ret <= 0)
{
BIO_printf(bio_err,
"RSA verify failure\n");
Index: verify.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/apps/verify.c,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.4.1
diff -L crypto/openssl/apps/verify.c -L crypto/openssl/apps/verify.c -u -r1.1.1.1 -r1.1.1.1.4.1
--- crypto/openssl/apps/verify.c
+++ crypto/openssl/apps/verify.c
@@ -275,7 +275,7 @@
ret=0;
end:
- if (i)
+ if (i > 0)
{
fprintf(stdout,"OK\n");
ret=1;
@@ -365,4 +365,3 @@
ERR_clear_error();
return(ok);
}
-
Index: spkac.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/apps/spkac.c,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.4.1
diff -L crypto/openssl/apps/spkac.c -L crypto/openssl/apps/spkac.c -u -r1.1.1.1 -r1.1.1.1.4.1
--- crypto/openssl/apps/spkac.c
+++ crypto/openssl/apps/spkac.c
@@ -284,7 +284,7 @@
pkey = NETSCAPE_SPKI_get_pubkey(spki);
if(verify) {
i = NETSCAPE_SPKI_verify(spki, pkey);
- if(i) BIO_printf(bio_err, "Signature OK\n");
+ if (i > 0) BIO_printf(bio_err, "Signature OK\n");
else {
BIO_printf(bio_err, "Signature Failure\n");
ERR_print_errors(bio_err);
Index: x509.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/apps/x509.c,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.4.1
diff -L crypto/openssl/apps/x509.c -L crypto/openssl/apps/x509.c -u -r1.1.1.1 -r1.1.1.1.4.1
--- crypto/openssl/apps/x509.c
+++ crypto/openssl/apps/x509.c
@@ -1113,7 +1113,7 @@
/* NOTE: this certificate can/should be self signed, unless it was
* a certificate request in which case it is not. */
X509_STORE_CTX_set_cert(&xsc,x);
- if (!reqfile && !X509_verify_cert(&xsc))
+ if (!reqfile && X509_verify_cert(&xsc) <= 0)
goto end;
if (!X509_check_private_key(xca,pkey))
Index: s3_srvr.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/ssl/s3_srvr.c,v
retrieving revision 1.2
retrieving revision 1.2.4.1
diff -L crypto/openssl/ssl/s3_srvr.c -L crypto/openssl/ssl/s3_srvr.c -u -r1.2 -r1.2.4.1
--- crypto/openssl/ssl/s3_srvr.c
+++ crypto/openssl/ssl/s3_srvr.c
@@ -2015,7 +2015,7 @@
else
{
i=ssl_verify_cert_chain(s,sk);
- if (!i)
+ if (i <= 0)
{
al=ssl_verify_alarm_type(s->verify_result);
SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
Index: s3_clnt.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/ssl/s3_clnt.c,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.4.1
diff -L crypto/openssl/ssl/s3_clnt.c -L crypto/openssl/ssl/s3_clnt.c -u -r1.1.1.1 -r1.1.1.1.4.1
--- crypto/openssl/ssl/s3_clnt.c
+++ crypto/openssl/ssl/s3_clnt.c
@@ -833,7 +833,7 @@
}
i=ssl_verify_cert_chain(s,sk);
- if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
+ if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
#ifndef OPENSSL_NO_KRB5
&& (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
!= (SSL_aKRB5|SSL_kKRB5)
@@ -1206,7 +1206,7 @@
EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
EVP_VerifyUpdate(&md_ctx,param,param_len);
- if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+ if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
{
/* bad signature */
al=SSL_AD_DECRYPT_ERROR;
Index: s2_clnt.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/ssl/s2_clnt.c,v
retrieving revision 1.2
retrieving revision 1.2.4.1
diff -L crypto/openssl/ssl/s2_clnt.c -L crypto/openssl/ssl/s2_clnt.c -u -r1.2 -r1.2.4.1
--- crypto/openssl/ssl/s2_clnt.c
+++ crypto/openssl/ssl/s2_clnt.c
@@ -1062,7 +1062,7 @@
i=ssl_verify_cert_chain(s,sk);
- if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
+ if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0))
{
SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
goto err;
Index: s2_srvr.c
===================================================================
RCS file: /home/cvs/src/crypto/openssl/ssl/s2_srvr.c,v
retrieving revision 1.1.1.1
retrieving revision 1.1.1.1.4.1
diff -L crypto/openssl/ssl/s2_srvr.c -L crypto/openssl/ssl/s2_srvr.c -u -r1.1.1.1 -r1.1.1.1.4.1
--- crypto/openssl/ssl/s2_srvr.c
+++ crypto/openssl/ssl/s2_srvr.c
@@ -1070,7 +1070,7 @@
i=ssl_verify_cert_chain(s,sk);
- if (i) /* we like the packet, now check the chksum */
+ if (i > 0) /* we like the packet, now check the chksum */
{
EVP_MD_CTX ctx;
EVP_PKEY *pkey=NULL;
@@ -1099,7 +1099,7 @@
EVP_PKEY_free(pkey);
EVP_MD_CTX_cleanup(&ctx);
- if (i)
+ if (i > 0)
{
if (s->session->peer != NULL)
X509_free(s->session->peer);
Index: newvers.sh
===================================================================
RCS file: /home/cvs/src/sys/conf/newvers.sh,v
retrieving revision 1.3.2.7
retrieving revision 1.3.2.8
diff -L sys/conf/newvers.sh -L sys/conf/newvers.sh -u -r1.3.2.7 -r1.3.2.8
--- sys/conf/newvers.sh
+++ sys/conf/newvers.sh
@@ -33,7 +33,7 @@
TYPE="MidnightBSD"
REVISION="0.2.1"
-BRANCH="RELEASE-p4"
+BRANCH="RELEASE-p5"
if [ "X${BRANCH_OVERRIDE}" != "X" ]; then
BRANCH=${BRANCH_OVERRIDE}
fi
More information about the Midnightbsd-cvs
mailing list