OpenSSL Patch Gets Patched - Security Intelligence

The OpenSSL project has been scrambling to get a badly needed patch out the door. OpenSSL, the cryptographic library used in many servers, released versions 1.1.0a, 1.0.2i and 1.0.1u on Sept. 22 to address more than a dozen security holes that had been affecting the software.

OpenSSL Patch Creates New Problems

The most serious vulnerability addressed in these releases, SecurityWeek reported, is CVE-2016-6304. This vulnerability can be exploited to conduct distributed denial-of-service (DDoS) attacks by sending an excessively large OCSP status request extension to the targeted server.

The OpenSSL patch also addressed excessive memory allocation in a header. This low-severity vulnerability (CVE-2016-6307) can only be exploited if certain specific conditions are met. However, OpenSSL fixed this problem with version 1.1.0a — or so it thought.

Patches Upon Patches

OpenSSL issued an advisory on Sept. 26 to address problems caused by the aforementioned updates.

Version 1.1.0a introduced a new, critical vulnerability that could lead to a crash or execution of arbitrary code. OpenSSL explained that this occurs when the server receives a message that exceeds 16k, resulting in the relocation and reallocation of the underlying buffer to store the incoming message.

“Unfortunately,” the advisory read, “a dangling pointer to the old location is left, which results in an attempt to write to the previously freed location.”

OpenSSL fixed the issue with version 1.1.0b.

Sanity Check

OpenSSL also dropped a sanity check in the first release. A bug fix including a CRL sanity check was added to OpenSSL 1.1.0. However, the code didn’t make it into OpenSSL 1.0.2i. This means any attempt to use CRLs in version 1.0.2i will crash with a null pointer exception. OpenSSL 1.0.2i users should upgrade to 1.0.2j.

In some respects, the agility with which OpenSSL identified and fixed these vulnerabilities is commendable. The project recognized the problem and quickly issued an advisory to rectify it.

Considering the unintended consequences of the Sept. 22 release, however, one can only hope OpenSSL found time to conduct the necessary testing for this batch of new software.

Larry Loeb

Principal, PBC Enterprises

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Passwords, passkeys and familiarity bias

5 min read - As passkey (passwordless authentication) adoption proceeds, misconceptions abound. There appears to be a widespread impression that passkeys may be more convenient and less secure than passwords. The reality is that they are both more secure and more convenient — possibly a first in cybersecurity.Most of us could be forgiven for not realizing passwordless authentication is more secure than passwords. Thinking back to the first couple of use cases I was exposed to — a phone operating system (OS) and a…

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

2 min read - The federal government recently took a new step toward prioritizing cybersecurity and demonstrating its commitment to reducing risk. On March 20, 2024, the Pentagon formally established the new Office of the Assistant Secretary of Defense for Cyber Policy to supervise cyber policy for the Department of Defense. The next day, President Joe Biden announced Michael Sulmeyer as his nominee for the role.“In standing up this office, the Department is giving cyber the focus and attention that Congress intended,” said Acting…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

OpenSSL Patch Creates New Problems

Patches Upon Patches

Sanity Check

More from

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Passwords, passkeys and familiarity bias

DOD establishes Office of the Assistant Secretary of Defense for Cyber Policy

Topic updates