OpenSSL 'ChangeCipherSpec' MiTM Potential Vulnerability

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote host is potentially affected by a vulnerability that could
allow sensitive data to be decrypted.

Description :

The OpenSSL service on the remote host is potentially vulnerable to a
man-in-the-middle (MiTM) attack, based on its response to two
consecutive 'ChangeCipherSpec' messages during the incorrect phase of
an SSL/TLS handshake.

This flaw could allow a MiTM attacker to decrypt or forge SSL messages
by telling the service to begin encrypted communications before key
material has been exchanged, which causes predictable keys to be used
to secure future traffic.

OpenSSL 1.0.1 is known to be exploitable. OpenSSL 0.9.8 and 1.0.0 are
not known to be vulnerable
however, the OpenSSL team has advised that
users of these older versions upgrade as a precaution. This plugin
detects and reports all versions of OpenSSL that are potentially
exploitable.

Note that Nessus has only tested for an SSL/TLS MiTM vulnerability
(CVE-2014-0224). However, Nessus has inferred that the OpenSSL service
on the remote host is also affected by six additional vulnerabilities
that were disclosed in OpenSSL's June 5th, 2014 security advisory :

- An error exists in the 'ssl3_read_bytes' function
that permits data to be injected into other sessions
or allows denial of service attacks. Note that this
issue is exploitable only if SSL_MODE_RELEASE_BUFFERS
is enabled. (CVE-2010-5298)

- An error exists related to the implementation of the
Elliptic Curve Digital Signature Algorithm (ECDSA) that
allows nonce disclosure via the 'FLUSH+RELOAD' cache
side-channel attack. (CVE-2014-0076)

- A buffer overflow error exists related to invalid DTLS
fragment handling that permits the execution of
arbitrary code or allows denial of service attacks.
Note that this issue only affects OpenSSL when used
as a DTLS client or server. (CVE-2014-0195)

- An error exists in the 'do_ssl3_write' function that
permits a NULL pointer to be dereferenced, which could
allow denial of service attacks. Note that this issue
is exploitable only if SSL_MODE_RELEASE_BUFFERS is
enabled. (CVE-2014-0198)

- An error exists related to DTLS handshake handling that
could allow denial of service attacks. Note that this
issue only affects OpenSSL when used as a DTLS client.
(CVE-2014-0221)

- An error exists in the 'dtls1_get_message_fragment'
function related to anonymous ECDH cipher suites. This
could allow denial of service attacks. Note that this
issue only affects OpenSSL TLS clients. (CVE-2014-3470)

OpenSSL did not release individual patches for these vulnerabilities,
instead they were all patched under a single version release. Note
that the service will remain vulnerable after patching until the
service or host is restarted.

See also :

http://www.nessus.org/u?d5709faa
https://www.imperialviolet.org/2014/06/05/earlyccs.html
https://www.openssl.org/news/secadv_20140605.txt

Solution :

OpenSSL 0.9.8 SSL/TLS users (client and/or server) should upgrade to
0.9.8za. OpenSSL 1.0.0 SSL/TLS users (client and/or server) should
upgrade to 1.0.0m. OpenSSL 1.0.1 SSL/TLS users (client and/or server)
should upgrade to 1.0.1h.

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 8.1
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true