Hi list, <INTRO> this is my first post. My name is Alfredo and I'm a PhD student at Cambridge University, UK. In my research project we automatically generate monitor implementations for standard protocols. In particular we are focussing on the session initialization of SSLv3. We believe our monitor could stop faulty protocol runs based on CVE-2008-5077, whereas openssl clients prior to 0.9.8j would let the session go on.
More info on my ongoing research project can be found at http://www.dai-arc.polito.it/dai-arc/manual/people/pironti/papers/monitoring/ </INTRO> In order to reach my goal, I need to exploit the aforecited bug by creating a malformed DSA certificate (I cannot change signature on exchanged data, because they are not part of the handshake, and so they are not currently monitored). Reading the security advisory, it should be possible to expliot the vulnerability this way: """ present a malformed SSL/TLS signature from a certificate chain to a vulnerable client, bypassing validation """ We already tried with self-signed certificates and depth-1 certificate chains, both by changing the signature data, and by changing the signature algorithm, to no avail. Versions 0.9.8i and 0.9.8j behave exactly the same. We are currently trying with the s_server and s_client "apps" and with the verify one, which has explicitly been patched. The verify tool does not start a protocol session, but exploiting the bug there would be a first step towards our results, showing their feasibility. Any idea on how to tweak a certificate so that the X509_verify_cert() at line 256 in apps/verify.c returns -1? Or any other general idea on how to exploit this vulnerability? Thank you for your valuable support. Regards, Alfredo ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List [email protected] Automated List Manager [email protected]
