Security
Another crypto downgrade attack: Logjam
If more evidence was needed that deliberately weakening cryptographic algorithms based on politics is likely to go astray, the new Logjam attack against TLS seems to provide it. All of that evidence probably won't stop politicians (and others) from further attempts to cripple crypto, sadly, but it may at least provide some guidance to those who must implement those decisions down the road. In the meantime, though, there is yet another attack against the encryption used by the web and other internet protocols.
Downgrade attack
There are two related pieces to Logjam. The first is a crypto downgrade attack (somewhat akin to the FREAK attack) that, once again, abuses the export-strength ciphers that were mandated by the US government and are often still supported for backward compatibility. In this case, though, the attack is against Diffie-Hellman (DH) key exchange, rather than the RSA keys targeted by FREAK. Also unlike FREAK, the Logjam crypto downgrade attack uses a flaw in the TLS protocol instead of exploiting a bug in some TLS implementations.
The basic problem that Logjam exploits is that the message a server sends for key exchange can be undetectably replaced with a weaker variant. The message that uses a DH key that has been restricted to using prime numbers of at most 512 bits for political reasons (i.e. DHE_EXPORT ciphers) and one that uses the non-export variety can't be distinguished by clients. So a properly functioning server that supports, but does not prefer, DHE_EXPORT ciphers will send a key exchange message using a 1024-bit (or larger) DH group (i.e. one that has been derived from a 1024-bit prime). A man in the middle can intercept that message and rewrite it using the server's 512-bit group without alerting the client that anything has changed.
It turns out that the vast majority of servers that support DHE_EXPORT also use the same 512-bit prime number. The Logjam paper [PDF] shows that 82% of DHE_EXPORT-supporting web servers used a prime that had been distributed with the Apache web server for a number of years. It also reports that nearly 5% of the 14.3 million HTTPS web sites supported DHE_EXPORT, so roughly 4% of the net is using that one prime number. This practice was not seen as a problem, as the paper notes:
In order to exploit the downgrade to DHE_EXPORT, an attacker needs to be able to calculate discrete logarithms in near real-time. It is a nearly impossible math problem, but one that is made vastly easier with access to the prime number of interest. Using that, the man in the middle can precompute values that allow it to extract the session key from the key exchange. Once that is obtained, the man in the middle can pretend to be the server with impunity; the client will be none the wiser.
On a system with four six-core Xeon processors, the researchers' proof of concept was able to crack the session key in an average of 90 seconds. That may seem like a long time for users to wait for the browser to connect to the server—and it is, at least for interactive sessions. There are a number of techniques described in the paper to work around that delay.
To
start with, non-interactive uses, such as curl or Git, are often
unattended so they have long timeouts and "we could hijack their
connections without much difficulty
". There is a TLS warning
alert mechanism that can be used to reset the browsers' handshake timers.
The delay still might be noticed by the user, however, so the attacker
might choose to compromise a request for some background resource that
won't delay the page display.
There is also the fact that many TLS implementations cache their ephemeral
key and reuse it multiple times; that allows the calculation to be done once
and to be used again and again.
Beyond that, more optimization or more powerful systems could potentially
reduce the average time to crack the key substantially.
Diffie-Hellman and state-level attackers
The second piece of the Logjam report looks at how vulnerable the DH key
exchange is to attack when there is no downgrade ability. Once again,
various protocols
often use (or even specify) the same prime numbers everywhere. The paper
specifically mentions SSH, TLS, and Internet Key
Exchange (IKE) which is used by IPsec.
Currently, 768-bit DH groups are
fairly widespread and the paper estimates that precomputing the values
needed would require around 36,000 core-years, which is "within
reach by computing power available to academics
". Once that
precomputation is done, doing a single 768-bit discrete log computation is
on the order of two core-days.
Perhaps even more eye-opening, though, is that 1024-bit DH groups are estimated to be crackable by state-level attackers (i.e. governments and their ilk). Precomputation is on the order of 45 million core-years, which is an enormous effort, but could be reduced with specialized hardware. Once that was done, the discrete log calculations could be done in roughly 30 core-days. That estimate leads to a possible answer to a question that has been asked frequently in the crypto community:
Documents leaked by Snowden indicate that the NSA has been passively decrypting virtual private network (VPN) traffic. The paper concludes that the documented information is consistent with an attack against the 1024-bit DH group used by IKE. That doesn't mean it is the mechanism used by the NSA, but it could be.
That leads the authors of the paper (David Adrian, Karthikeyan Bhargavan, Zakir Durumeric, Pierrick Gaudry, Matthew Green, J. Alex Halderman, Nadia Heninger, Drew Springall, Emmanuel Thomé, Luke Valenta, Benjamin VanderSloot, Eric Wustrow, Santiago Zanella-Béguelin, and Paul Zimmermann) to a number of recommendations. Disabling DHE_EXPORT ciphers, and configuring the other DHE ciphers to use groups of 2048 bits or larger, head that list. Browsers and other clients should require groups of at least 1024 bits to avoid the downgrade attack but still interoperate with servers that have not been upgraded.
Avoiding fixed-prime groups is another recommendation, as is transitioning to elliptic curve DH (ECDH), which does not provide as much of an advantage for precomputation. The parameters for ECDH still need to be worked out—those recommended by the US government are viewed with suspicion due to NSA influence on their choice.
The last two recommendations are admonishments to politicians and the
crypto community respectively. First: "In combination with FREAK,
our attacks warn of the long-term
debilitating effects of deliberately weakening cryptography.
" But
there is also lots of room for better communication by the crypto
community:
For those wanting to check their status, the Logjam web site will warn if their browser is susceptible to the attack (i.e. if it will accept DH groups with less than 1024 bits). Another page provides tools to test servers and information on how to upgrade those that are found to have an inadequate DH group size (i.e. less than 2048). For example, the LWN.net server needs an upgrade to its DH group, which we will be taking care of soon.
This research is quite timely, interesting, and important, though it may not require a "drop everything" response—at least for sites that don't support DHE_EXPORT. For those that believe their traffic may be targeted by state-level attackers, however, prudence would seem to indicate a faster response. At this point, after the information leaked by Snowden and others, these kinds of attacks seem a little less surprising—we have known that secret services were decrypting lots of this data for some time. Now, at least, we may know some of the "how" as well.
Brief items
Security quotes of the week
Hardening Hypervisors Against VENOM-Style Attacks (Xen Project Blog)
The Xen Project looks at a mechanism to mitigate vulnerabilities like VENOM that attack emulation layers in QEMU. "The good news is it’s easy to mitigate all present and future QEMU bugs, which the recent Xen Security Advisory emphasized as well. Stubdomains can nip the whole class of vulnerabilities exposed by QEMU in the bud by moving QEMU into a de-privileged domain of its own. Instead of having QEMU run as root in dom0, a stubdomain has access only to the VM it is providing emulation for. Thus, an escape through QEMU will only land an attacker in a stubdomain, without access to critical resources. Furthermore, QEMU in a stubdomain runs on MiniOS, so an attacker would only have a very limited environment to run code in (as in return-to-libc/ROP-style), having exactly the same level of privilege as in the domain where the attack started. Nothing is to be gained for a lot of work, effectively making the system as secure as it would be if only PV drivers were used." The Red Hat Security Blog also noted this kind of mitigation for VENOM-style attacks.
New vulnerabilities
avidemux: denial of service
| Package(s): | avidemux | CVE #(s): | CVE-2015-1872 | ||||||||||||||||
| Created: | May 19, 2015 | Updated: | May 20, 2015 | ||||||||||||||||
| Description: | From the Mageia advisory:
An attacker can force a read at an invalid address in mjpegdec.c of FFmpeg, in order to trigger a denial of service. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
avidemux: multiple vulnerabilities
| Package(s): | avidemux | CVE #(s): | CVE-2014-9316 CVE-2014-9317 CVE-2014-9603 CVE-2015-3417 | ||||||||||||||||
| Created: | May 19, 2015 | Updated: | June 15, 2015 | ||||||||||||||||
| Description: | From the CVE entries:
The mjpeg_decode_app function in libavcodec/mjpegdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via vectors related to LJIF tags in an MJPEG file. (CVE-2014-9316) The decode_ihdr_chunk function in libavcodec/pngdec.c in FFMpeg before 2.1.6, 2.2.x through 2.3.x, and 2.4.x before 2.4.4 allows remote attackers to cause a denial of service (out-of-bounds heap access) and possibly have other unspecified impact via an IDAT before an IHDR in a PNG file. (CVE-2014-9317) The vmd_decode function in libavcodec/vmdvideo.c in FFmpeg before 2.5.2 does not validate the relationship between a certain length value and the frame width, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Sierra VMD video data. (CVE-2014-9603) Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data. (CVE-2015-3417)
| ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
dcraw: denial of service
| Package(s): | dcraw | CVE #(s): | CVE-2015-3885 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 14, 2015 | Updated: | January 23, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
The dcraw tool bundled in darktable's libraw copy suffers from an integer overflow condition which leads to a buffer overflow. A maliciously crafted raw image file can be used to trigger the vulnerability, causing a Denial of Service condition. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
gnutls: signature algorithm verification botch
| Package(s): | gnutls | CVE #(s): | |||||
| Created: | May 14, 2015 | Updated: | May 20, 2015 | ||||
| Description: | From the Red Hat bugzilla entry:
It was reported by the GnuTLS project that a ServerKeyExchange signature sent by the server is not verified to be in the acceptable by the client set of algorithms. That has the effect of allowing MD5 signatures (which are disabled by default) in the ServerKeyExchange message. It is not believed that this bug can be exploited because a fraudulent signature has to be generated in real-time which is not known to be possible. However, since attacks can only get better it is recommended to update to a GnuTLS version which addresses the issue. | ||||||
| Alerts: |
| ||||||
kernel: privilege escalation
| Package(s): | kernel | CVE #(s): | CVE-2014-9710 | ||||||||||||||||||||||||
| Created: | May 20, 2015 | Updated: | May 20, 2015 | ||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Alexandre Oliva reported a race condition flaw in the btrfs file system's handling of extended attributes (xattrs). A local attacker could exploit this flaw to bypass ACLs and potentially escalate privileges. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
moodle: multiple vulnerabilities
| Package(s): | moodle | CVE #(s): | CVE-2015-3174 CVE-2015-3175 CVE-2015-3176 CVE-2015-3178 CVE-2015-3179 CVE-2015-3180 CVE-2015-3181 | ||||||||||||
| Created: | May 19, 2015 | Updated: | May 20, 2015 | ||||||||||||
| Description: | From the Mageia advisory:
In Moodle before 2.6.11, leaving gradebook feedback is a trusted action and such capabilities in other modules already have an XSS mask, 'mod/quiz:grade' was missing this flag (CVE-2015-3174). In Moodle before 2.6.11, some error messages display a button to return to the previous page. Redirecting to non-local referer should not be allowed as it can potentially be used for phising (CVE-2015-3175). In Moodle before 2.6.11, on sites with enabled self-registration, not registered users can retrieve fullname of registered users if they know their usernames (CVE-2015-3176). In Moodle before 2.6.11, if a user who is not XSS-trusted attempts to insert a script as part of the input text, it will be cleaned when displayed on the Moodle website but may be displayed uncleaned in the external application because external_format_text() cleans and formats text incorrectly when returning it from Web Services (CVE-2015-3178). In Moodle before 2.6.11, when self-registration is enabled and a user's account was suspended after creating the account but before actually confirming it, the user is still able to login when confirming their email, but only once (CVE-2015-3179). In Moodle before 2.6.11, if a user is enrolled in the course but his enrollment is suspended, they can not access the course but still were able to see the course structure in the navigation block (CVE-2015-3180). In Moodle before 2.6.11, users with the revoked capability 'moodle/user:manageownfiles' are still able to upload private files using a deprecated function in Web Services (CVE-2015-3181). | ||||||||||||||
| Alerts: |
| ||||||||||||||
nbd: denial of service
| Package(s): | nbd | CVE #(s): | CVE-2015-0847 | ||||||||||||||||||||||||||||
| Created: | May 18, 2015 | Updated: | August 14, 2015 | ||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
Tuomas Räsänen discovered that unsafe signal handling is present in nbd-server. This vulnerability could be exploited by a remote client to cause a denial of service. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
NetworkManager: denial of service
| Package(s): | NetworkManager | CVE #(s): | CVE-2015-2924 | ||||||||||||||||||||
| Created: | May 18, 2015 | Updated: | November 26, 2015 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
NetworkManager: denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
php: multiple vulnerabilities
| Package(s): | php | CVE #(s): | CVE-2015-4021 CVE-2015-4022 CVE-2015-4024 CVE-2015-4025 CVE-2015-4026 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 19, 2015 | Updated: | June 25, 2015 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From Mageia's updated advisory:
Memory Corruption in phar_parse_tarfile when entry filename starts with null (CVE-2015-4021). Integer overflow in ftp_genlist() resulting in heap overflow, potentially exploitable by a hostile FTP server (CVE-2015-4022). PHP Multipart/form-data parsing remote DoS Vulnerability (CVE-2015-4024). Various functions allow \0 in paths where they shouldn't. In theory, that could lead to security failure for path-based access controls if the user injects a string with \0 in it. These functions include set_include_path(), tempnam(), rmdir(), and readlink() (CVE-2015-4025), as well as pcntl_exec() (CVE-2015-4026). PHP 5.5.25 and 5.6.9 have been released fixing multiple bugs and potential security issues. See the PHP 5.5.25 changelog and the PHP 5.6.9 changelog for details. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
php-ZendFramework2: CRLF injection
| Package(s): | php-ZendFramework2 | CVE #(s): | CVE-2015-3154 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 20, 2015 | Updated: | June 9, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Zend advisory:
CRLF (Carriage Return "\r" and Line Feed "\n") is a significant sequence of characters, representing the the End Of Line (EOL) marker for many Internet protocols, including, but not limited to MIME (e-mail), NNTP (newsgroups), and, more importantly, HTTP. When programmers write code for web applications, they split headers based on where the CRLF is found. If a malicious user is able to inject his own CRLF sequence into an HTTP stream, he is able to maliciously control the way a web application functions. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
phpMyAdmin: two vulnerabilities
| Package(s): | phpMyAdmin | CVE #(s): | CVE-2015-3902 CVE-2015-3903 | ||||||||||||||||||||||||||||
| Created: | May 18, 2015 | Updated: | May 26, 2015 | ||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2015-3902: By deceiving a user to click on a crafted URL, it is possible to alter the configuration file being generated with phpMyAdmin setup. Versions 4.0.x (prior to 4.0.10.10), 4.2.x (prior to 4.2.13.3), 4.3.x (prior to 4.3.13.1) and 4.4.x (prior to 4.4.6.1) are affected. CVE-2015-3903: A vulnerability in the API call to GitHub can be exploited to perform a man-in-the-middle attack. Versions 4.0.x (prior to 4.0.10.10), 4.2.x (prior to 4.2.13.3), 4.3.x (prior to 4.3.13.1) and 4.4.x (prior to 4.4.6.1) are affected. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
qemu: denial of service
| Package(s): | qemu | CVE #(s): | CVE-2014-9718 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 14, 2015 | Updated: | May 20, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
CVE-2014-9718: It was discovered that the IDE controller emulation is susceptible to denial of service. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
ruby-rest-client: session fixation attack
| Package(s): | ruby-rest-client | CVE #(s): | CVE-2015-1820 | ||||
| Created: | May 18, 2015 | Updated: | May 20, 2015 | ||||
| Description: | From the Mageia advisory:
When Ruby rest-client processes an HTTP redirection response, it blindly passes along the values from any Set-Cookie headers to the redirection target, regardless of domain, path, or expiration. This can be used in a session fixation attack or in stealing cookies. | ||||||
| Alerts: |
| ||||||
wireshark: multiple vulnerabilities
| Package(s): | wireshark-cli | CVE #(s): | CVE-2015-3808 CVE-2015-3809 CVE-2015-3810 CVE-2015-3813 CVE-2015-3815 | ||||||||||||||||||||||||||||||||||||
| Created: | May 15, 2015 | Updated: | May 20, 2015 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory: CVE-2015-3808 - There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. CVE-2015-3809 - There is an infinite loop condition in dissect_lbmr_pser() in epan/dissectors/packet-lbmr.c. It's possible for an attacker to set the the variable 'option_len' to 0, causing the loop to never terminate. This issue is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. CVE-2015-3810 - The Websocket dissector recurses to dissect more data. Since the minimum valid websocket frame length is two bytes, this allows for quite some recursion. With a minimal IP and TCP header (20 bytes each), you can get 32747 recursions which is leading to excessive CPU resources consumption by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. CVE-2015-3813 - It has been discovered that the packet reassembly code could leak memory under certain circumstances. This may lead to crash by excessive memory consumption via injecting malformed packets onto the wire or by convincing someone to read a malformed packet trace file. CVE-2015-3815 - It has been discovered that the Android Logcat file parser could crash under certain circumstances. This issue is leading to denial of service by injecting a malformed packet onto the wire or by convincing someone to read a malformed packet trace file. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
wireshark: three dissector vulnerabilities
| Package(s): | wireshark | CVE #(s): | CVE-2015-3811 CVE-2015-3812 CVE-2015-3814 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | May 14, 2015 | Updated: | June 11, 2015 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
The WCP dissector could crash while decompressing data (CVE-2015-3811). The X11 dissector could leak memory (CVE-2015-3812). The IEEE 802.11 dissector could go into an infinite loop (CVE-2015-3814). | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>