1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
Patch Package: OTP 19.3.6.4
Git Tag: OTP-19.3.6.4
Date: 2017-11-23
Trouble Report Id: OTP-14748
Seq num:
System: OTP
Release: 19
Application: ssl-8.1.3.1
Predecessor: OTP 19.3.6.3
Check out the git tag OTP-19.3.6.4, and build a full OTP system
including documentation. Apply one or more applications from this
build as patches to your installation using the 'otp_patch_apply'
tool. For information on install requirements, see descriptions for
each application version below.
---------------------------------------------------------------------
--- ssl-8.1.3.1 -----------------------------------------------------
---------------------------------------------------------------------
Note! The ssl-8.1.3.1 application can *not* be applied independently
of other applications on an arbitrary OTP 19 installation.
On a full OTP 19 installation, also the following runtime
dependency has to be satisfied:
-- stdlib-3.2 (first satisfied in OTP 19.2)
--- Fixed Bugs and Malfunctions ---
OTP-14748 Application(s): ssl
An erlang TLS server configured with cipher suites
using rsa key exchange, may be vulnerable to an
Adaptive Chosen Ciphertext attack (AKA Bleichenbacher
attack) against RSA, which when exploited, may result
in plaintext recovery of encrypted messages and/or a
Man-in-the-middle (MiTM) attack, despite the attacker
not having gained access to the server’s private key
itself. CVE-2017-1000385
Exploiting this vulnerability to perform plaintext
recovery of encrypted messages will, in most practical
cases, allow an attacker to read the plaintext only
after the session has completed. Only TLS sessions
established using RSA key exchange are vulnerable to
this attack.
Exploiting this vulnerability to conduct a MiTM attack
requires the attacker to complete the initial attack,
which may require thousands of server requests, during
the handshake phase of the targeted session within the
window of the configured handshake timeout. This attack
may be conducted against any TLS session using RSA
signatures, but only if cipher suites using RSA key
exchange are also enabled on the server. The limited
window of opportunity, limitations in bandwidth, and
latency make this attack significantly more difficult
to execute.
RSA key exchange is enabled by default although least
prioritized if server order is honored. For such a
cipher suite to be chosen it must also be supported by
the client and probably the only shared cipher suite.
Captured TLS sessions encrypted with ephemeral cipher
suites (DHE or ECDHE) are not at risk for subsequent
decryption due to this vulnerability.
As a workaround if default cipher suite configuration
was used you can configure the server to not use
vulnerable suites with the ciphers option like this:
{ciphers, [Suite || Suite <- ssl:cipher_suites(),
element(1,Suite) =/= rsa]}
that is your code will look somethingh like this:
ssl:listen(Port, [{ciphers, [Suite || Suite <-
ssl:cipher_suites(), element(1,S) =/= rsa]} |
Options]).
Thanks to Hanno Böck, Juraj Somorovsky and Craig Young
for reporting this vulnerability.
Full runtime dependencies of ssl-8.1.3.1: crypto-3.3, erts-7.0,
inets-5.10.7, kernel-3.0, public_key-1.2, stdlib-3.2
---------------------------------------------------------------------
---------------------------------------------------------------------
---------------------------------------------------------------------
|
