Allele Security Alert
ASA-2019-00114
Identifier(s)
ASA-2019-00114, CVE-2019-1559
Title
0-byte record padding oracle
Vendor(s)
The OpenSSL Project
Product(s)
OpenSSL
Affected version(s)
OpenSSL 1.0.2
Fixed version(s)
OpenSSL 1.0.2r
Proof of concept
Unknown
Description
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data.
In order for this to be exploitable “non-stitched” ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). AEAD ciphersuites are not impacted.
Technical details
Unknown
Credits
Juraj Somorovsky, Robert Merget, Nimrod Aviram, Steven Collison and Andrew Hourselt
Reference(s)
0-byte record padding oracle (CVE-2019-1559)
https://www.openssl.org/news/secadv/20190226.txt
OpenSSL Security Advisory
https://mta.openssl.org/pipermail/openssl-announce/2019-February/000148.html
Go into the error state if a fatal alert is sent or received
https://github.com/openssl/openssl/commit/e9bbefbf0f24c57645e7ad6a5a71ae649d18ac8e
USN-3899-1: OpenSSL vulnerability
https://usn.ubuntu.com/3899-1/
Bug 1683804 (CVE-2019-1559) – CVE-2019-1559 openssl: 0-byte record padding oracle
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-1559
February 2019 Security Releases
https://nodejs.org/en/blog/vulnerability/february-2019-security-releases/
CVE-2019-1559
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1559
CVE-2019-1559
https://nvd.nist.gov/vuln/detail/CVE-2019-1559
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: March 6, 2019