GRUPO 40121

TLS V1.2 Sigalgs Remote Crash (CVE-2015-0291)


OpenSSL 1.0.2a fix several security issues, one of them let crash TLSv1.2 based services remotelly from internet.


Regarding to the TLSv1.2 RFC,  this version of TLS provides a "signature_algorithms" extension for the client_hello. 

Data Structures


If a bad signature is sent after the renegotiation, the structure will be corrupted, becouse structure pointer:
s->c->shared_sigalgs will be NULL, and the number of algorithms:
s->c->shared_sigalgslen will not be zeroed.
Which will be interpreted as one algorithm to process, but the pointer points to 0x00 address. 


Then tls1_process_sigalgs() will try to process one signature algorithm (becouse of shared_sigalgslen=1) then sigptr will be pointer to c->shared_sigalgs (NULL) and then will try to derreference sigptr->rhash. 


This mean a Segmentation Fault in  tls1_process_sigalgs() function, and called by tls1_set_server_sigalgs() with is called from ssl3_client_hello() as the stack trace shows.




StackTrace

The following code, points sigptr to null and try to read sigptr->rsign, which is assembled as movzbl eax,  byte ptr [0x0+R12] note in register window that R12 is 0x00

Debugger in the crash point.


radare2 static decompiled


The patch fix the vulnerability zeroing the sigalgslen.
Get  David A. Ramos' proof of concept exploit here





Related news
  1. Easy Hack Tools
  2. Hacker Tools Windows
  3. Pentest Tools
  4. Hacking Tools Online
  5. New Hacker Tools
  6. Hacker Tools For Ios
  7. Pentest Box Tools Download
  8. Underground Hacker Sites
  9. Pentest Tools Apk
  10. Beginner Hacker Tools
  11. Ethical Hacker Tools
  12. Nsa Hacker Tools
  13. Pentest Tools Port Scanner
  14. Bluetooth Hacking Tools Kali
  15. Install Pentest Tools Ubuntu
  16. Hacking Apps
  17. Hack App
  18. Hacker Search Tools
  19. Black Hat Hacker Tools
  20. Hacking Tools And Software
  21. Ethical Hacker Tools
  22. Hacking Tools Windows 10
  23. Hacking Tools For Windows Free Download
  24. Hacker Tools Hardware
  25. Hacking Tools Name

No hay comentarios:

Publicar un comentario

Nota: solo los miembros de este blog pueden publicar comentarios.