Original issue date: June 26, 1998<BR>
Last revised: August 24, 1998<BR>
Added vendor information for Silicon Graphics, Inc.
<P>A complete revision history is at the end of this file.
<P>The CERT Coordination Center has received a report regarding a vulnerability
in some implementations of products utilizing RSA Laboratories' Public-Key
Cryptography Standard #1 (PKCS#1). Under some situations, a sophisticated
intruder may be able to use the vulnerability in PKCS#1 to recover
information from SSL-encrypted sessions.
<P>The CERT/CC team recommends that sites install patches immediately as
described in Appendix A. Appendix A also contains pointers to web pages
containing additional information maintained by some vendors.
<P>We will update this advisory as we receive additional information. Please
check our advisory files regularly for updates that relate to your site.
<P><HR>
<P>
<H1>I. Description</H1>
<P>PKCS#1 is a standard for encrypting data using the RSA public-key
cryptosystem. Its intended use is in the construction of digital
signatures and digital envelopes.
<P>One use for the digital envelopes constructed using PKCS#1 is to
provide confidentiality during the session key negotiation of an
SSL-encrypted session. The SSL protocol is widely used to encrypt
traffic to and from web servers to protect the privacy of information
such as personal data or a credit card number, as it traverses the
internet. A sophisticated intruder may be able to use the
vulnerability in PKCS#1 to recover information from an SSL-encrypted
session.
<P>Web pages employing SSL are accessed using the HTTPS protocol,
rather than the HTTP protocol.
<P>More information about PKCS#1 can be found at
<P><A HREF="http://www.rsa.com/rsalabs/pubs/PKCS/">
http://www.rsa.com/rsalabs/pubs/PKCS/</A>
<P>Additional information regarding this vulnerability will be
available at
<P><A HREF="http://www.bell-labs.com">http://www.bell-labs.com</A>
<P>This vulnerability does not affect all PKCS#1-enabled products. The
attack is not effective against protocols in which there is not an
interactive session setup, or where the error messages returned by the
server do not distinguish among the types of failures. In particular,
this vulnerability does not affect S/MIME or SET.
<P>
<H1>II. Impact</H1>
Under some circumstances, an intruder who is able to observe an
SSL-encrypted session, and subsequently interrogate the server
involved in the session, may be able to recover the session key used
in that session, and then recover the encrypted data from that
session.
<P>The vulnerability can only be exploited if the intruder is able to
make repeated session-establishment attempts to the same vulnerable
web server which was involved in the original session. In addition,
the server must return error messages that distinguish between several
modes of failure. Although the number of session-establishment
requests is large, it is significantly more efficient than a
brute-force attack against the session key. Note that, although web
servers comprise the majority of vulnerable servers, other
PKCS#1-enabled servers may be vulnerable.
<P>Note that the server's public and private key are not at risk from
this vulnerability, and that an intruder is only able to recover data
from a single session per attack. Compromising a single session does
not give an intruder any additional ability to compromise subsequent
sessions. Further, as mentioned above, this vulnerability does not
affect all PKCS#1-enabled products.
<P>
<A NAME="III"></A>
<H1>III. Solution</H1>
<OL>
<H3><LI TYPE="A">Obtain and install a patch for this problem.</H3>
<A HREF="#AppA">Appendix A</A> contains input from vendors who have provided information
for this advisory. We will update the appendix as we receive more
information. If you do not see your vendor's name, the CERT/CC did
not hear from that vendor. Please contact your vendor directly.
<P>
<H3><LI TYPE="A">Although applying vendor patches is the recommended course of action, you may wish to consider some of the following steps to reduce your exposure to this vulnerability:</H3>
<P>
<OL>
<LI>Examine your log files for repeated error messages indicating
failed requests for session-establishment. For example, sites using
C2Net's Stronghold server would see error messages of the form
<PRE>
[Tue Jun 23 22:08:17 1998] SSL accept error
1575:error:0407006B:rsa routines:RSA_padding_check_PKCS1_type_2:block type is not 02:rsa_pk1.c:207
1575:error:04064072:rsa routines:RSA_EAY_PRIVATE_DECRYPT:padding check failed:rsa_eay.c:330
1575:error:1408B076:SSL routines:SSL3_GET_CLIENT_KEY_EXCHANGE:bad rsa
decrypt:s3_srvr.c:1259
</PRE>
<LI>If you are unable to upgrade for an extended period of time, you
may wish to consider obtaining a new public/private key pair for
servers. Changing the key pair only protects those sessions which may
have been previously recorded by an intruder. This does not prevent
an intruder from launching attacks against newly-recorded
sessions. This should only be considered in those cases where
upgrading is infeasible. Again, note that the public/private key pair
is not at risk from this vulnerability.
<LI><P>Avoid using the same public/private key pair across multiple
servers.
<LI><P>A large increase in CPU utilization or network traffic may
accompany an attack. If your web server does not provide sufficient
detail in its logs to detect failures, you may wish to look for
substantial deviation from established usage patterns, which may be
indicative of an attack.
<P>Implementors and researchers should consult RSA Laboratories Bulletin
Number 7 for additional measures to reduce the effectiveness of this
attack. This document will be available at
<P>
<A
HREF="http://www.rsa.com/rsalabs/">http://www.rsa.com/rsalabs/</A>
</OL>
</OL>
<P><HR>
<P>
<A NAME="AppA"></A>
<H1>Appendix A - Vendor Information</H1>
<P>Below is a list of the vendors who have provided information for this
advisory. We will update this appendix as we receive additional information.
If you do not see your vendor's name, the CERT/CC did not hear from that
vendor. Please contact the vendor directly.
<P>
<H4>C2Net Software, Inc.</H4>
<P>
<PRE>
C2Net has developed a patch and is deploying new builds to combat this
problem. More information is available at http://www.c2.net
</PRE>
<P>
<H4>Microsoft Corporation</H4>
<P>
<PRE>
The Microsoft Product Security Response Team has produced an update for the
following affected Microsoft Internet server software:
- Microsoft Internet Information Server 3.0 and 4.0
- Microsoft Site Server 3.0, Commerce Edition
- Microsoft Site Server, Enterprise Edition
- Microsoft Exchange 5.0 and 5.5 (for SSL-enabled POP3 and SMTP)
Microsoft's Internet server software provides SSL 2.0, SSL 3.0, PCT 1.0, and
TLS 1.0 for securing Internet-based communications. These protocols are all
implemented in a single file called SCHANNEL.DLL, which is shared by the
Microsoft Internet server software listed above. Updating this single file
will resolve this vulnerability for these Microsoft server products.
No updates are required for Internet client software, such as Internet
Explorer.
This update is now available. Microsoft strongly recommends that customers
using secure SSL Internet services with any of the Microsoft products listed
above should update to the latest version of SCHANNEL.DLL.
Please visit the Microsoft Security Advisor web site for more information, or
link directly to our Microsoft security bulletin MS98-002 at
http://www.microsoft.com/security/bulletins/ms98-002.htm
</PRE>
<P>
<H4>Netscape Communications Corporation</H4>
<P>
<PRE>
Netscape recommends that all customers running Netscape Enterprise Server
software, Netscape Proxy Server, Netscape Messaging Server and Netscape
Collabra Server download and install a simple patch before an attack ever
happens.
Product updates and full information about the countermeasures are available
immediately from the Netscape Internet site at:
http://help.netscape.com/products/server/ssldiscovery/index.html
</PRE>
<P>
<H4>Open Market, Inc.</H4>
<P>
<PRE>
Some of Open Market's products are affected by this vulnerability. Patches are
available. For more information, go to http://www.openmarket.com/security
</PRE>
<P>
<H4>RSA Data Security, Inc.</H4>
<P>
<PRE>
Information from RSA regarding this vulnerability is available at
http://www.rsa.com/rsalabs/
</PRE>
<P>
<H4>Silicon Graphics, Inc.</H4>
<P>See Silicon Graphics Inc. Security Advisory, "Vulnerability in Public-Key Cryptography Standard #1 (PKCS#1)," 19980606-01-A, issued June 26, 1998.
<P>Currently, Silicon Graphics Inc. is investigating and is in communication with
Netscape. No further information is available for public release at this time.
<P>The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1)
or its mirror, ftp.sgi.com. Security information and patches
can be found in the ~ftp/security and ~ftp/patches
directories, respectfully.
<P>For subscribing to the wiretap mailing list and other SGI security
related information, please refer to the Silicon Graphics
Security Headquarters website located at:
<P><A HREF=" http://www.sgi.com/Support/security"> http://www.sgi.com/Support/security</A>
<H4>SSLeay</H4>
<P>
<PRE>
Information and SSLeay source patches related to this vulnerability are
available at http://www.ssleay.org/announce/
</PRE>
<P>
<H4>Terisa Systems, Inc. / Spyrus, Inc.</H4>
<P>
<PRE>
Terisa has determined that the SSL implementation in the Terisa SecureWeb
Toolkit is vulnerable to this attack. A patch to fix this vulnerability has
been developed for existing versions of the Toolkit. Further information may
be found at http://www.terisa.com/.
</PRE>
<P>
<HR>
This vulnerability was originally discovered by Daniel Bleichenbacher of the
Secure Systems Research Department of Bell Labs, the research and development
arm of Lucent Technologies.
<P>The CERT Coordination Center thanks Scott Schnell of RSA and Jason Garms of
Microsoft for reporting this problem to us and providing technical advice and
other valuable input into the construction of this advisory. In addition, our
thanks goes to Simona Nass, Douglas Barnes, and Tim Hudson of C2Net and David
Wagner of the University of California at Berkeley for the example log files
contained herein as well as additional technical advice and clarification
during the production of this advisory.
<p><!--#include virtual="/include/footer_nocopyright.html" --> </p>
<p>Copyright 1998 Carnegie Mellon University.</p>
<HR>
Revision History
<PRE>
Aug. 24, 1998 Added vendor information for Silicon Graphics, Inc.
July 27, 1998 Added vendor information for Terisa Systems, Inc. / Spyrus, Inc.
</PRE>
|