CVE-2018-15836 (published 2018-09-26T21:29Z)

In verify_signed_hash() in lib/liboswkeys/signatures.c in Openswan before 2.6.50.1, the RSA implementation does not verify the value of padding string during PKCS#1 v1.5 signature verification. Consequently, a remote attacker can forge signatures when small public exponents are being used. IKEv2 signature verification is affected when RAW RSA keys are used.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/xelerance/Openswan
commit_details: repo_url: https://github.com/xelerance/Openswan
author: Samir Hussain
author_date: 2018-08-24 12:18:42-04:00
msg: Update VERSION to 2.6.50.1
repository: repo_url: https://github.com/xelerance/Openswan
repo_name: xelerance/Openswan
description: Openswan
repo_language: C
owner: xelerance
file_changes: filename: CHANGES
change_type: ModificationType.MODIFY
diff: @@ -4,6 +4,19 @@ of version numbers, so you will find 2.5.x and 2.6.x releases intersperced.
 
 See also docs/KNOWN_BUGS.txt and https://github.com/xelerance/Openswan/issues
 
+v2.6.50.1 (August 24, 2018)
+
+This release fixes CVE-2018-15836 (a Bleichenbacher-style signature
+forgery which involves RSA padding attack)
+
+* wo#7449 . test case for Bleichenbacher-style signature forgery [Bart Trojanowski]
+* wo#7449 . verify padding contents for IKEv2 RSA sig check [Bart Trojanowski]
+* wo#7449 . added lo06-verifybadsigs test case [Bart Trojanowski]
+* b01-install test case will no longer spam with the environment
+  variables [Bart Trojanowski]
+* lp28-addrinfoserialize: IP address for moon changed to
+  192.139.46.82 [Bart Trojanowski]
+
 v2.6.50 (August 3, 2017)
 
 Bug fixes for RSA key size and other issues

programming_language: Markdown
filename: Makefile.ver
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-IPSECBASEVERSION=2.6.50
+IPSECBASEVERSION=2.6.50.1

programming_language: Batchfile
filename: NEWS
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
-openswan (1:2.6.50-0xelerance1) trusty; urgency=low
+openswan (1:2.6.50.1-0xelerance1) trusty; urgency=low
 
-  * Update to 2.6.50
+  * Update to 2.6.50.1
 
   The real changelog is in /usr/share/doc/openswan/changelog.gz
 

programming_language: Markdown
filename: changelog
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
-openswan (1:2.6.50-0xelerance1) trusty; urgency=low
+openswan (1:2.6.50.1-0xelerance1) trusty; urgency=low
 
-  * Update to 2.6.50
+  * Update to 2.6.50.1
 
   The real changelog is in /usr/share/doc/openswan/changelog.gz
 

programming_language: Markdown
filename: openswan.spec
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 Summary: Openswan IPsec implementation
 Name: openswan
-Version: 2.6.50
+Version: 2.6.50.1
 %{!?buildklips: %{expand: %%define buildklips 0}}
 %{!?buildxen: %{expand: %%define buildxen 0}}
 

programming_language: Shell
filename: openswan.spec
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 Summary: Openswan IPsec implementation
 Name: openswan
-Version: 2.6.50
+Version: 2.6.50.1
 # Build KLIPS kernel module?
 %{!?buildklips: %{expand: %%define buildklips 0}}
 %{!?buildxen: %{expand: %%define buildxen 0}}

programming_language: Shell
filename: openswan.spec
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 Summary: Openswan IPsec implementation
 Name: openswanX
-Version: 2.6.50
+Version: 2.6.50.1
 
 # Openswan -pre/-rc nomenclature has to co-exist with hyphen paranoia
 %define srcpkgver %(echo %{version} | tr -s '_' '-')

programming_language: Shell
filename: openswan.spec
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@
 
 Summary: Openswan IPSEC implementation
 Name: openswan
-Version: 2.6.50
+Version: 2.6.50.1
 # Build KLIPS kernel module?
 %{!?buildklips: %{expand: %%define buildklips 0}}
 

programming_language: Shell
repo_url: https://github.com/xelerance/Openswan
commit_details: repo_url: https://github.com/xelerance/Openswan
author: Bart Trojanowski
author_date: 2018-08-14 14:06:37-04:00
msg: wo#7449 . verify padding contents for IKEv2 RSA sig check

Special thanks to Sze Yiu Chau of Purdue University (schau@purdue.edu)
who reported the issue.
repository: repo_url: https://github.com/xelerance/Openswan
repo_name: xelerance/Openswan
description: Openswan
repo_language: C
owner: xelerance
file_changes: filename: signatures.c
change_type: ModificationType.MODIFY
diff: @@ -157,8 +157,21 @@ err_t verify_signed_hash(const struct RSA_public_key *k
 	return "3""SIG padding does not check out";
     }
 
-    s += padlen + 3;
-    (*psig) = s;
+    /* signature starts after ASN wrapped padding [00,01,FF..FF,00] */
+    (*psig) = s + padlen + 3;
+
+    /* verify padding contents */
+    {
+        const u_char *p;
+        size_t cnt_ffs = 0;
+
+        for (p = s+2; p < s+padlen+2; p++)
+            if (*p == 0xFF)
+                cnt_ffs ++;
+
+        if (cnt_ffs != padlen)
+            return "4" "invalid Padding String";
+    }
 
     /* return SUCCESS */
     return NULL;

programming_language: C