OpenSSL fixes serious flaw that could enable man-in-the-middle attacks

The vulnerability allows attackers to generate rogue certificates that pass OpenSSL's validation

Digital key

Digital key

A flaw in the widely used OpenSSL library could allow man-in-the-middle attackers to impersonate HTTPS servers and snoop on encrypted traffic. Most browsers are not affected, but other applications and embedded devices could be.

The OpenSSL 1.0.1p and 1.0.2d versions released Thursday fix an issue that could be used to bypass certain checks and trick OpenSSL to treat any valid certificates as belonging to certificate authorities. Attackers could exploit this to generate rogue certificates for any website that would be accepted by OpenSSL.

"This vulnerability is really only useful to an active attacker, who is already capable of performing a man-in-the-middle (MITM) attack, either locally or upstream from the victim," said Tod Beardsley, security engineering manager at Rapid7, via email. "This limits the feasibility of attacks to actors who are already in a privileged position on one of the hops between the client and the server, or is on the same LAN and can impersonate DNS or gateways."

The problem was introduced in OpenSSL versions 1.0.1n and 1.0.2b that were released on June 11 to fix five other security vulnerabilities. Developers and server administrators who did the right thing and updated their OpenSSL versions last month, should do so again immediately.

OpenSSL versions 1.0.1o and 1.0.2c that were released on June 12 are also affected.

"This issue will impact any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication," the OpenSSL Project said in a security advisory published Thursday.

An example of servers that validate client certificates for authentication are VPN servers.

Fortunately, the four major browsers are not impacted because they don't use OpenSSL for certificate validation. Mozilla Firefox, Apple Safari and Internet Explorer use their own crypto libraries and Google Chrome uses BoringSSL, a Google-maintained fork of OpenSSL. The BoringSSL developers actually discovered this new vulnerability and submitted the patch for it to OpenSSL.

The real-world impact is likely not very high. There are desktop and mobile applications that use OpenSSL to encrypt their Internet traffic, as well as servers and Internet-of-Things devices that use it to secure machine-to-machine communications.

But even so, their number is small compared to the number of Web browser installations and it's unlikely that many of them use a recent version of OpenSSL that is vulnerable, said Ivan Ristic, director of engineering at security vendor Qualys and creator of SSL Labs.

For example, the OpenSSL packages distributed with some Linux distributions, including Red Hat, Debian and Ubuntu are not affected. That's because Linux distributions typically backport security fixes into their packages instead of completely updating them to new versions.

Join the CSO newsletter!

Error: Please check your email address.

Tags patchessecurityRapid7patch managementencryptionOpenSSL ProjectExploits / vulnerabilities

More about AppleDebianGoogleLANLinuxMozillaQualysRapid7Red HatUbuntu

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place