Allele Security Alert
ASA-2019-00477
Identifier(s)
ASA-2019-00477, CVE-2019-1552
Title
Windows builds with insecure path defaults
Vendor(s)
The OpenSSL Project
Product(s)
OpenSSL
Affected version(s)
OpenSSL version 1.1.1
OpenSSL version 1.1.0
OpenSSL version 1.0.2
Fixed version(s)
OpenSSL versions with the following commits applied:
OpenSSL version 1.1.1
Fix default installation paths on mingw
https://github.com/openssl/openssl/commit/54aa9d51b09d67e90db443f682cface795f5af9e
OpenSSL version 1.1.0
Fix default installation paths on mingw
https://github.com/openssl/openssl/commit/e32bc855a81a2d48d215c506bdeb4f598045f7e9
Makefile.shared: fix to allow strings and spaces in passed variables
https://github.com/openssl/openssl/commit/b15a19c148384e73338aa7c5b12652138e35ed28
OpenSSL version 1.0.2
Document issue with default installation paths on diverse Windows targets
https://github.com/openssl/openssl/commit/d333ebaf9c77332754a9d5e111e2f53e1de54fdd
Proof of concept
Unknown
Description
OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR, and is configurable with the –prefix / –openssldir configuration options.
For OpenSSL versions 1.1.0 and 1.1.1, the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be ‘/usr/local’.
However, mingw programs are Windows programs, and as such, find themselves looking at sub-directories of ‘C:/usr/local’, which may be world writable, which enables untrusted users to modify OpenSSL’s default configuration, insert CA certificates, modify (or even replace) existing engine modules, etc.
Technical details
Unknown
Credits
Rich Mirch
Reference(s)
Windows builds with insecure path defaults (CVE-2019-1552)
https://www.openssl.org/news/secadv/20190730.txt
Fix default installation paths on mingw
https://github.com/openssl/openssl/commit/54aa9d51b09d67e90db443f682cface795f5af9e
Fix default installation paths on mingw
https://github.com/openssl/openssl/commit/e32bc855a81a2d48d215c506bdeb4f598045f7e9
Makefile.shared: fix to allow strings and spaces in passed variables
https://github.com/openssl/openssl/commit/b15a19c148384e73338aa7c5b12652138e35ed28
Document issue with default installation paths on diverse Windows targets
https://github.com/openssl/openssl/commit/d333ebaf9c77332754a9d5e111e2f53e1de54fdd
ASA-2019-00377 – London Trust Media Private Internet Access: Privilege Escalation due to malicious OpenSSL engine
https://allelesecurity.com/asa-2019-00377/
CVE-2019-12572 PIA Windows Privilege Escalation: Malicious OpenSSL Engine
https://blog.mirch.io/2019/06/10/cve-2019-12572-pia-windows-privilege-escalation-malicious-openssl-engine/
CVE-2019-1552
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1552
CVE-2019-1552
https://nvd.nist.gov/vuln/detail/CVE-2019-1552
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: August 5, 2019