Date: Wed, 4 May 2016 10:47:11 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com> Subject: Older OpenSSL RSA key/64 bit bug (now with added CVE!) ---------- Forwarded message ---------- From: <cve-assign@...re.org> Date: Wed, May 4, 2016 at 9:25 AM Subject: Re: [oss-security] broken RSA keys To: solar@...nwall.com Cc: cve-assign@...re.org, kseifried@...hat.com -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > On Wed, May 04, 2016 at 07:50:24AM -0600, Kurt Seifried wrote: >> Is this something we should look at with respect to CVE assignment (ala >> CVE-2008-0166)? > The old OpenSSL bug from 2000 could get a CVE from 2000, since that's > when it was publicly reported >>> http://marc.info/?l=openssl-users&m=95961024500509 >>> >>> Under 64 bit HP-UX, >>> the problem manifests itself as RSA_F4 becoming 0x1000100010001. The bug >>> is that 1 is an int, and according to the ANSI C standard, shifting more >>> than the size of the an expression is undefined. On this architechture, >>> only the 5 least significant bits of the shift is used, thus 1<<32==1 Use CVE-2000-1254. The commit is: https://git.openssl.org/?p=openssl.git;a=commit;h=db82b8f9bd432a59aea8e1014694e15fc457c2bb (We are not sure how this CVE ID would be used. It is possible that nobody will use this ID for OpenSSL risk management, but someone will use this ID in deciding to pursue further research on "shifting more than the size of an expression" issues.) If this ID is sent in an oss-security followup, the Subject: header should be changed to mention OpenSSL. Also, MITRE currently plans to publish the CVE for this along with the CVEs for the OpenSSL 2016-05-03 issues, which should be very soon. - -- CVE Assignment Team M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJXKhODAAoJEHb/MwWLVhi2bREQAKYSRGk+hCcwiAy19+RYQC1g AvRnK7+5kJnLXVdQO7K2yPQo1aLHcKgbmv+VNcu9tf4kJg/7ebROecdgrtWXHzI1 yksyozDzX574LtFuyBWDax7ethEWdHY1BSmSWRIUOmFj6IOTSks8eI7T5rgEd+Gp dB2kRLSKEWlPV1ld6B//bfnW1bo/cbfuEgxCkpYh97zwbADSZdGltTqpvzQGt6d/ BRCDLoV688aTS1lEqrrmxcf4BaAWUa1TMHuCg3GSuTfnu8iVDvOuuMrvDItpmovk 5/Z3G/Z23RHwAq6R8yMmXPdDq4aelS0IzxuFCCEU9zCcZsAc90HP1Vt6CDgOQagW kVRMi2wTVsy+FqlMyDN5CeGDmwlKe5BegAB/sanRzUlv4gn0/rpF223bvgKcYYRc 4LJlOMxhn+eymktp+8neJhwlR5rWzC2Na4HxJFitKQmv2FnQhzYD3BvNyhQSPwJ9 k4ky1/+/T6WyxNNXsA2DnqbYBgDD4crq58IDHfdVEBXpq+wiyGT+b32FS1+fLC29 cIi97XUrzUh6Fzvx1m3Bjwbt31B/lWs13iNy8qz5Z+91Y6ud5UERqjZ2ogv/AVIX Na3ycUizKATKRdfr2WuEOFXR5Cu+rLB8ayPVlKAc8bNeUcWpOoWUrWTsTyBC0rzT yka/lgb3X77XRXs9gYgt =yEbu -----END PGP SIGNATURE----- -- -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.