Date: Sat, 24 Mar 2018 23:48:29 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Stack buffer overflow in WolfSSL before 3.13.0 https://blog.fuzzing-project.org/63-Stack-buffer-overflow-in-WolfSSL-before-3.13.0.html During some tests of TLS libraries I found a stack buffer overflow vulnerability in the WolfSSL library. Finding this one was surprisingly simple: I had a wolfssl server that was compiled with address sanitizer and ran the SSL Labs test against it. The bug happens in the parsing of the signature hash algorithm list that is sent in a ClientHello and is basically a textbook stack buffer overflow. WolfSSL simply tries to store that in an array with 32 elements. If one sends more than 32 hash algorithms it overflows. With the SSL Labs scan the bug only causes WolfSSL to terminate if it's compiled with address sanitizer, but if one sends a very large list of hash algorithms it also crashes in a normal compile. In situations where WolfSSL is used without ASLR this bug is probably trivially exploitable. I have created a simple bash proof of concept  (using netcat and xxd) that crashes a WolfSSL server. The bug was fixed in this commit  and in version 3.13.0 of WolfSSL.  https://github.com/hannob/wolfoverflow  https://github.com/wolfSSL/wolfssl/pull/1231/commits/9f7e40ad5c8097ff38d7caff4a9989db260981cc -- Hanno Böck https://hboeck.de/ mail/jabber: hanno@...eck.de GPG: FE73757FA60E4E21B937579FA5880072BBB51E42
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.