CVE-2015-1793 (Alternative chains certificate forgery)

Thanks to Bill Brenner:

The OpenSSL team advisory outlines the vulnerability and fixes. The advisory states:

During certificate verification, OpenSSL (starting from version 1.0.1n and 1.0.2b) will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted certificates to be bypassed, such as the CA flag, enabling them to use a valid leaf certificate to act as a CA and "issue" an invalid certificate. This issue impacts any application that verifies certificates including SSL/TLS/DTLS clients and SSL/TLS/DTLS servers using client authentication.

The vulnerability was reported to OpenSSL on 24th June 2015 by Adam Langley/David Benjamin (Google/BoringSSL). The fix was developed by the BoringSSL project, and released by OpenSSL on July 9th, 2015.

As per definition of the verify operation by OpenSSL.org:

The verify program uses the same functions as the internal SSL and S/MIME verification, therefore this description applies to these verify operations too.

There is one crucial difference between the verify operations performed by the verify program: wherever possible an attempt is made to continue after an error whereas normally the verify operation would halt on the first error. This allows all the problems with a certificate chain to be determined.

The verify operation consists of a number of separate steps.

Firstly a certificate chain is built up starting from the supplied certificate and ending in the root CA. It is an error if the whole chain cannot be built up. The chain is built up by looking up the issuers certificate of the current certificate. If a certificate is found which is its own issuer it is assumed to be the root CA.

The process of 'looking up the issuers certificate' itself involves a number of steps. In versions of OpenSSL before 0.9.5a the first certificate whose subject name matched the issuer of the current certificate was assumed to be the issuers certificate. In OpenSSL 0.9.6 and later all certificates whose subject name matches the issuer name of the current certificate are subject to further tests. The relevant authority key identifier components of the current certificate (if present) must match the subject key identifier (if present) and issuer and serial number of the candidate issuer, in addition the keyUsage extension of the candidate issuer (if present) must permit certificate signing.

The lookup first looks in the list of untrusted certificates and if no match is found the remaining lookups are from the trusted certificates. The root CA is always looked up in the trusted certificate list: if the certificate to verify is a root certificate then an exact match must be found in the trusted list.

The second operation is to check every untrusted certificate's extensions for consistency with the supplied purpose. If the -purpose option is not included then no checks are done. The supplied or "leaf" certificate must have extensions compatible with the supplied purpose and all other certificates must also be valid CA certificates. The precise extensions required are described in more detail in the CERTIFICATE EXTENSIONS section of the x509 utility.

The third operation is to check the trust settings on the root CA. The root CA should be trusted for the supplied purpose. For compatibility with previous versions of SSLeay and OpenSSL a certificate with no trust settings is considered to be valid for all purposes.

The final operation is to check the validity of the certificate chain. The validity period is checked against the current system time and the notBefore and notAfter dates in the certificate. The certificate signatures are also checked at this point.

If all operations complete successfully then certificate is considered valid. If any operation fails then the certificate is not valid.

Conclusion by Thomas Pomin:

• The attacker is in position to intercept all network traffic from the victim (e.g. the attacker operates the WiFi access point to which the victim unwisely connected).

• The attacker owns (legitimately !) some domain, let's call it "evilattacker.com", and has bought a completely valid certificate with that name in it; namely, the attacker owns a certificate A, that contains the name www.evilattacker.com, and is signed by some trusted root V. The attacker pushes a copy of that certificate (the public key) on a publicly accessible Web site, say his own site; the corresponding URL may be (for instance) http://www.evilattacker.com/cert.crt (it could also be on any kind of public hosting, it does not matter).

• The victim wants to connect to its bank site. His browser tries to open a SSL session with www.bank.com.

• The attacker intercepts that connection and pretends to be the bank. To that effect, the attacker sends a certificate chain C,X (in that order) where:

  • C is a synthetic certificate that contains the name www.bank.com, and is signed with the attacker's own private key, and contains an Authority Information Access extension with a URL equal to http://www.evilattacker.com/cert.crt (that is, pointing to where the attacker has published his own certificate C).
  • X is random junk.

What I've learned:

Although this is not an exploit you start with as it's pretty hard to build up the surronding scenario, it seems a quite good demonstration of the insecurity of all SSL related communication. Nevertheless, I agree in the risk classification of being moderate as you must intercept all the traffic between client and server. The only "easy" to etsablish situation I think of right now, would be any free WiFi on the street or in the coffee shop around the corner.

Well I hope you think about it when doing your online banking next time. :-)