openssl, branch OpenSSL_0_9_8zb

Prepare for 0.9.8zb release

2014-08-06T21:29:20Z

Reviewed-by: Stephen Henson

Updates to CHANGES and NEWS

2014-08-06T21:02:00Z

Reviewed-by: Kurt Roeckx

Fix OID handling:

2014-08-06T21:02:00Z

- Upon parsing, reject OIDs with invalid base-128 encoding. - Always NUL-terminate the destination buffer in OBJ_obj2txt printing function. CVE-2014-3508 Reviewed-by: Dr. Stephen Henson Reviewed-by: Kurt Roeckx Reviewed-by: Tim Hudson

Fix DTLS anonymous EC(DH) denial of service

2014-08-06T21:02:00Z

CVE-2014-3510 Reviewed-by: Dr. Stephen Henson

Fix protocol downgrade bug in case of fragmented packets

2014-08-06T21:02:00Z

CVE-2014-3511 Reviewed-by: Emilia Käsper Reviewed-by: Bodo Möller

Remove some duplicate DTLS code.

2014-08-06T21:02:00Z

Applying same fix as in dtls1_process_out_of_seq_message. A truncated DTLS fragment would cause *ok to be clear, but the return value would still be the number of bytes read.

2014-08-06T21:02:00Z

Problem identified by Emilia Käsper, based on previous issue/patch by Adam Langley. Reviewed-by: Emilia Käsper

Fix return code for truncated DTLS fragment.

2014-08-06T21:02:00Z

Previously, a truncated DTLS fragment in |dtls1_process_out_of_seq_message| would cause *ok to be cleared, but the return value would still be the number of bytes read. This would cause |dtls1_get_message| not to consider it an error and it would continue processing as normal until the calling function noticed that *ok was zero. I can't see an exploit here because |dtls1_get_message| uses |s->init_num| as the length, which will always be zero from what I can see. Reviewed-by: Matt Caswell Reviewed-by: Emilia Käsper

Fix memory leak from zero-length DTLS fragments.

2014-08-06T21:02:00Z

The |pqueue_insert| function can fail if one attempts to insert a duplicate sequence number. When handling a fragment of an out of sequence message, |dtls1_process_out_of_seq_message| would not call |dtls1_reassemble_fragment| if the fragment's length was zero. It would then allocate a fresh fragment and attempt to insert it, but ignore the return value, leaking the fragment. This allows an attacker to exhaust the memory of a DTLS peer. Fixes CVE-2014-3507 Reviewed-by: Matt Caswell Reviewed-by: Emilia Käsper

Fix DTLS handshake message size checks.

2014-08-06T21:02:00Z

In |dtls1_reassemble_fragment|, the value of |msg_hdr->frag_off+frag_len| was being checked against the maximum handshake message size, but then |msg_len| bytes were allocated for the fragment buffer. This means that so long as the fragment was within the allowed size, the pending handshake message could consume 16MB + 2MB (for the reassembly bitmap). Approx 10 outstanding handshake messages are allowed, meaning that an attacker could consume ~180MB per DTLS connection. In the non-fragmented path (in |dtls1_process_out_of_seq_message|), no check was applied. Fixes CVE-2014-3506 Wholly based on patch by Adam Langley with one minor amendment. Reviewed-by: Emilia Käsper