The OpenSSL Project released an update on Thursday that addresses seven vulnerabilities – including one that could enable a man-in-the-middle (MitM) attack and another that could potentially be exploited to run arbitrary code – but experts do not believe any are as threatening as the Heartbleed bug.
Not every version of OpenSSL is vulnerable to every flaw, but to play it safe, users – client and server – are advised to upgrade to OpenSSL 0.9.8za from OpenSSL 0.9.8, to OpenSSL 1.0.0m from OpenSSL 1.0.0, and to OpenSSL 1.0.1h from OpenSSL 1.0.1.
The vulnerability, CVE-2014-0224, is considered the most dangerous because it enables an attacker to decrypt and modify traffic between SSL/TLS clients and servers in a MitM attack, according to a security advisory posted on Thursday.
To exploit the bug, both the server and the client must be running vulnerable versions of OpenSSL, Nicholas Percoco, vice president of strategic services at Rapid7, told SCMagazine.com in a Thursday email correspondence.
“The attacker would utilize this vulnerability to force the client/server communication to use very weak keys – used to encrypt the information being transmitted – that can then result in the eavesdropping or modification of the data being exchanged,” Percoco said, adding that an attacker could compromise important personal data as a result, such as banking information.
The attack is more dangerous because the client, server and network based security controls will be unable to detect that anything is happening, but the blow is softened a bit because the majority of commercial browsers do not use OpenSSL, thus reducing the impact, Percoco said.
CVE-2014-0195 impacts applications using OpenSSL as a DTLS client or server and could enable a buffer overflow attack, according to the advisory, which adds that the flaw could also potentially be exploited to run arbitrary code.
“At this point, there is no proof of concept exploit available that I am aware of [to run arbitrary code],” Johannes Ullrich, dean of research with the SANS Technology Institute, told SCMagazine.com in a Thursday email correspondence.
The remaining vulnerabilities are more limited in scope, Percoco said.
CVE-2014-0221 impacts applications using OpenSSL as a DTLS client and can result in a denial-of-service (DoS) attack, while CVE-2014-3470 leaves OpenSSL TLS clients enabling anonymous ECDH ciphersuites open to DoS.
Where SSL_MODE_RELEASE_BUFFERS is enabled, CVE-2014-0198 can enable remote attackers to carry out a DoS attack through a NULL pointer dereference, and CVE-2010-5298 is a race condition in the ss13_read_bytes function that can enable remote attackers to inject data across sessions or carry out a DoS attack, according to the advisory.
The update additionally contains a fix for CVE-2014-0076, which could make it easier for local users to obtain ECDSA nonces using a side-channel attack.
“None of these issues are anything like the severity of Heartbleed,” Craig Young, a security researcher with Tripwire, said in a statement emailed to SCMagazine.com on Thursday.
The Heartbleed bug was reported on heavily beginning in April, when it was learned that the critical vulnerability existed in widely used versions of the OpenSSL library and could result in decryption of communications that use SSL/TLS encryption.
