Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 05 Mar 2014 11:11:07 +0530
From: Huzaifa Sidhpurwala <>
Subject: libssh and stunnel PRNG flaws

Hi All,

Aris Adamantiadis reported the following to us:

I have found a vulnerability in stunnel (fork mode) and libssh server
(if implemented with fork) that is similar to problems found in
postgresql [1]. When accepting a new connection, the server forks and
the child process handles the request. The RAND_bytes() function of
openssl doesn't reset its state after the fork, but simply adds the
current process id (getpid) to the PRNG state, which is not guaranteed
to be unique.

stunnel uses libssl, which also seeds the PRNG with the output of
time(NULL), which means that vulnerability has to be exploited under a
second. I have exploit code that can reproduce the issue on OpenBSD 5.4
(thanks to random PIDs) but I think it may be exploitable on other unix
systems as well.

The following CVEs have been assigned:

CVE-2014-0016 stunnel PRNG vulnerability
CVE-2014-0017 libssh PRNG vulnerability

Mitigations implemented into openssl-0.9.8j (2009) makes the
vulnerability not exploitable in stock openssl. The signing code for
ECDSA and DSA explicitly seeds the pool with the digest to sign.



There is no upstream patch yet


Huzaifa Sidhpurwala / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.