root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Fix bug in CVE-2011-4619: check we have really received a client hello 

before rejecting multiple SGC restarts.
This commit is contained in:
Dr. Stephen Henson 2012-02-16 15:26:04 +00:00
parent 5863163732
commit 206310c305
2 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
CHANGES
View File

@ -548,6 +548,13 @@
Add command line options to s_client/s_server. Add command line options to s_client/s_server.
[Steve Henson] [Steve Henson]
Changes between 1.0.0g and 1.0.0h [xx XXX xxxx]
*) Fix CVE-2011-4619: make sure we really are receiving a
client hello before rejecting multiple SGC restarts. Thanks to
Ivan Nestlerode <inestlerode@us.ibm.com> for discovering this bug.
[Steve Henson]
Changes between 1.0.0f and 1.0.0g [18 Jan 2012] Changes between 1.0.0f and 1.0.0g [18 Jan 2012]
*) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109. *) Fix for DTLS DoS issue introduced by fix for CVE-2011-4109.

15
ssl/s3_srvr.c
View File

@ -873,14 +873,6 @@ int ssl3_check_client_hello(SSL *s)
int ok; int ok;
long n; long n;
/* We only allow the client to restart the handshake once per
* negotiation. */
if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
{
SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
return -1;
}
/* this function is called when we really expect a Certificate message, /* this function is called when we really expect a Certificate message,
* so permit appropriate message length */ * so permit appropriate message length */
n=s->method->ssl_get_message(s, n=s->method->ssl_get_message(s,
@ -893,6 +885,13 @@ int ssl3_check_client_hello(SSL *s)
s->s3->tmp.reuse_message = 1; s->s3->tmp.reuse_message = 1;
if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO) if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
{ {
/* We only allow the client to restart the handshake once per
* negotiation. */
if (s->s3->flags & SSL3_FLAGS_SGC_RESTART_DONE)
{
SSLerr(SSL_F_SSL3_CHECK_CLIENT_HELLO, SSL_R_MULTIPLE_SGC_RESTARTS);
return -1;
}
/* Throw away what we have done so far in the current handshake, /* Throw away what we have done so far in the current handshake,
* which will now be aborted. (A full SSL_clear would be too much.) */ * which will now be aborted. (A full SSL_clear would be too much.) */
#ifndef OPENSSL_NO_DH #ifndef OPENSSL_NO_DH