Title

Private key leak via weak OpenSSL PRNG handling with FORK threading

Description

Affected versions of stunnel using fork threading do not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool, allowing remote attackers to obtain private keys for ECDSA or DSA certificates.

When accepting a new connection, the server forks and the child process handles the request. The RAND_bytes() function of OpenSSL does not reset its state after the fork, but simply adds the current PID to the PRNG state, which is not guaranteed to be unique. OpenSSL also seeds the PRNG with the output of time(NULL), which means that the vulnerability must be exploited in less than one second.

However, mitigations implemented in OpenSSL 0.9.8j make the vulnerability unexploitable in the stock version of OpenSSL. The signing code for ECDSA and DSA explicitly seeds the pool with the digest to sign. The signing code in the OpenSSL FIPS module does not have that mitigation, but more recent versions of OpenSSL use a high-resolution timer to seed the DRBG.

Exploitability

The vulnerability is exploitable under the following conditions:

Impact

An attacker may be able to extract the private ECDSA or DSA key.

CVSS v2 Score

CVSS v2 Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:N/E:H/RL:OF/RC:C)

Recommendation

Upgrade to stunnel 4.57 or later, or rebuild stunnel with a different threading mode.

Credits

Our supporters:
Go to the top