[Openswan dev] ANNOUNCE: Security Advisory CAN-2004-590 - X.509
Digital Certificate Handling
ken at xelerance.com
Mon Jun 28 11:51:03 CEST 2004
-----BEGIN PGP SIGNED MESSAGE-----
Certificate chain authentication in Openswan pluto
NOT YET PUBLISHED
Revision of advisory:
This problem was discovered by Thomas Walpuski of IKS GmbH Jena.
No exploit is known to be available.
* superfreeswan 1.x (all revisions with X.509 patch)
* openswan 1.x < 1.0.6
* openswan 2.x < 2.1.4
* strongSwan <2.1.3
* Any version of FreeS/WAN 1.x with X.509 patch < 0.9.41
* Any version of FreeS/WAN 2.x with X.509 patch < 1.6.1
To be vulnerable one must be using X.509/pkix key material that is
authenticated with a CA.
Self-signed certificates that are loaded from disk are not affected, nor
are PSK, RSA (from disk or DNS) or Opportunistic Encryption.
Given a policy exists that is based upon X.509 DN identities that permits
identity "B" to establish some kind of tunnel with a gateway or end
system, and B's credentials may be attested to by a trusted Certificate
This vulnerability permits a malicious end-system to make up their own
Certificate Authority A' such that it has issuer=B, and subject=A',
followed by a self-signed end-certificate with issuer B and subject B.
When presented, this certificate chain will validate permitting the
attacker to impersonate B.
The attacker must know a valid DN B to use, and must match the policy
which B is authorized to use. As openswan does not use aggressive mode by
default, (and does not include it in version 2), it is not possible to
learn identity B by passive eavesdropping. B may be guessed, determined by
social engineering, or may be retrieved by an active man-in-the-middle
Vendor status and information
http://www.freeswan.org/ - no longer active
All vendors have been notified and have provided patched versions.
* a) apply patch or upgrade to >=1.0.5 or >=2.1.3 versions of Openswan.
Patch URL: http://anoncvs.openswan.org/cgi-bin/viewcvs.cgi/openswan-1/pluto/x509.c.diff?r1=1.23&r2=1.25&diff_format=u
* b) only accept certificates for the remote system which are signed
by the same CA as the local system. This can be done by setting "rightca=%same".
The mechanism which is used to authenticate the certificate chain
presented by an end-system errorneously sees the issuer=B/subject=B as a
trusted root CA when it has not yet been verified.
Openswan test case fail-x509-09 provides a more detailed analysis.
Email: vuln at xelerance.com
Phone: +1 905 257 3392
The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-0590 to this issue. This is a candidate for inclusion in the
CVE list (http://cve.mitre.org), which standardizes names for security
Ken Bantoft VP Business Development
ken at xelerance.com Xelerance Corporation
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
-----END PGP SIGNATURE-----
More information about the Dev