Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2006.0944 -- [Solaris]
Security Vulnerability With RSA Signatures Affects Solaris WAN Boot
14 November 2007
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Solaris
Publisher: Sun Microsystems
Operating System: Solaris 9 and 10
Impact: Inappropriate Access
Access: Remote/Unauthenticated
CVE Names: CVE-2006-4339 CVE-2006-2937 CVE-2006-2940
Ref: ESB-2007.0473
ESB-2007.0271
ESB-2006.0728
Original Bulletin:
http://sunsolve.sun.com/search/printfriendly.do?assetkey=1-26-102759-1
Revision History: November 14 2007: Updated the Impact section to include
additional related CVEs.
Updated the Relief/Workaround to state
the absence of a workaround to avoid
the Denial of Service Vulnerablilty.
Updated the Resolution section to
include the fix for Solaris 9.
July 30 2007: Patches available for SUNWcry package
December 27 2006: Solaris 10 patches now available
December 27 2006: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
Sun(sm) Alert Notification
* Sun Alert ID: 102759
* Synopsis: Security Vulnerabilities in OpenSSL Affect Solaris WAN
Boot
* Category: Security
* Product: Solaris 9 Operating System, Solaris 10 Operating System
* BugIDs: 6467218, 6476279
* Avoidance: Patch, Workaround
* State: Resolved
* Date Released: 22-Dec-2006, 09-Nov-2007
* Date Closed: 09-Nov-2007
* Date Modified: 24-Apr-2007, 23-Jul-2007, 09-Nov-2007
1. Impact
Multiple vulnerabilities in the OpenSSL product impact the Solaris WAN
boot software.
An RSA signature forgery vulnerability may allow an untrusted server
or client to present a forged identity to the other party during
remote software installation when SSL is in use with certain types of
certificates. This would allow the security restrictions of that SSL
configuration to be circumvented.
Additionally, security vulnerabilities in the ASN.1 parser
implementation and public key handling in the OpenSSL library may
allow a user who is running a client system that is able to connect to
a WAN Boot installation server to cause a Denial Of Service (DoS) to
that server. This could prevent the server from providing service to
WAN Boot clients. Clients connecting to an untrusted server may also
be impacted by this issue.
Note that the WAN Boot software uses a static version of the OpenSSL
libraries, meaning that the Solaris 10 resolution for Sun Alert
102744, which corrects applications dynamically linking to the Solaris
OpenSSL libraries, is not sufficient to resolve this issue for the WAN
Boot software. This Sun Alert will describe the full impact and
resolution for the WAN Boot software.
These issues are also described in the following documents:
CERT VU#845620 at http://www.kb.cert.org/vuls/id/845620
CVE-2006-4339 at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339
http://www.openssl.org/news/secadv_20060928.txt
CVE-2006-2937 at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937
CVE-2006-2940 at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940
Note: This Sun Alert is specific to the Solaris WAN Boot software.
Multiple Sun products are affected by the RSA signature forgery issue;
for more details please see Sun Alert 102648 at
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102648-1
2. Contributing Factors
This issue can occur in the following releases:
SPARC Platform
* Solaris 9 (12/03 or later) without patch 117123-08
* Solaris 10 without patch 121229-02
x86 Platform
* Solaris 9 (12/03 or later) without patch 122715-02
* Solaris 10 without patch 121230-02
Notes:
1. Solaris 8 does not include The WAN boot software, and is not
impacted by this issue.
2. WAN Boot only supports installation to SPARC-based clients.
3. A WAN Boot remote installation will only be affected by this issue
if it is configured to download the installation data by a secure SSL
connection for either:
a) the initial stages of the installation when the client downloads
its boot environment from the server
or
b) the latter stages of the installation when the JumpStart
configuration and the installation media are downloaded in the form of
Solaris Flash archives (which may come from a different server than
that mentioned in item 'a' above).
Whether or not SSL is used in these ways during the WAN Boot
installation process is determined by the configuration which is
maintained by the server and distributed to the client during the
installation. The server may maintain different configurations for
different clients, each of which may or may not use SSL.
To determine if SSL will be used during the initial stages of the
installation of a specific client according to the configuration
maintained on the server, the wanboot.conf(4) file that is stored on
the server and is associated with that client can be checked (taking
into account that there may be multiple wanboot.conf files on the
system for different clients or groups of clients). For example, to
confirm if server or client authentication is in use for a certain
client installation, a command such as the following can be used:
# grep _authentication /etc/netboot/<optional_net_and_client_id>/wanboot.co
nf
server_authentication=yes
client_authentication=yes
To determine if SSL is used to download the JumpStart configuration
the system configuration file associated with the client being
installed should be checked. The location and name of this file will
be determined by the 'system_conf' setting in the wanboot.conf file.
For example:
# grep https: /etc/netboot/<name_of_system_configuration_file>
SsysidCF=https://192.186.1.1/flash/
SjumpsCF=https://192.186.1.1/flash/
To determine if SSL will be used to download the Solaris Flash
archives, the JumpStart configuration which is stored on the
installation server at a location configured in the system
configuration file can be checked using a command such as the
following:
# grep archive_location <path_to_jumpstart_config>/profile
archive_location https://192.186.1.1/flash_archive.flar
If the returned URL begins with 'https:' the flash archive will be
downloaded using SSL.
The RSA signature forgery issue only affects signatures which are made
using keys based on the RSA algorithm with an exponent of 3. Tools
such as openssl(1) (which is shipped with Solaris 10, Solaris 9 does
not include a tool which can be used for this purpose) can be used to
determine the algorithm and exponent setting associated with a certain
key. The exact method will depend on the tool and the configuration.
For example, to display the details of a certificate which is stored
in a PKCS12 formatted file (as passed to the wanbootutil(1M)'s
'pkcs12split' subcommand during the initial WAN Boot setup), the
openssl application could be used in the following way:
$ openssl pkcs12 -in <pkcs12-file> -nokeys | openssl x509 -text | egrep 'Ex
ponent:|Public Key Algorithm:'
Enter Import Password:
MAC verified OK
Public Key Algorithm: rsaEncryption
Exponent: 65537 (0x10001)
Some parts of the WAN Boot software that are affected by this
vulnerability may be installed independently from the standard
locations. For example, the 'wanboot-cgi' program will be installed in
a location where it can be served by the web server software that is
installed on the server host. In addition, clients which do not
support WAN Boot installations from the OBP may be booting from a
CDROM, from where they will acquire the 'wanboot' application. All of
these extra items will need to be updated for the resolution to be
fully active.
3. Symptoms
There are no symptoms that would indicate that these vulnerabilities
have been exploited to forge RSA signatures. If the issues mentioned
above have been exploited to cause a Denial of Service, processes
belonging to the affected applications will be consuming unusually
large amounts of CPU time and memory, and other applications running
on the system may be slow or unresponsive.
For the client side this means it could hang while booting or
performing installation via WAN boot.
Commands such as prstat(1M) can be used to determine the utilization
of system resources on the server side, for example:
$ prstat -s cpu
[...]
$ prstat -s size
[...]
4. Relief/Workaround
To workaround the RSA signature verification vulnerability it is
possible that the certificates in use can be replaced with
certificates which use an exponent other than 3. For more details
about how this can be done, consult the documentation which
accompanies the software that is used to create the certificates, or
consult the organization which provides the certificates.
There is no workaround to prevent these issues from being exploited to
cause a Denial of Service.
5. Resolution
This issue is addressed in the following releases:
SPARC Platform
* Solaris 9 (12/03 or later) with patch 117123-08 or later
* Solaris 10 with patch 121229-02 or later
x86 Platform
* Solaris 9 (12/03 or later) with patch 122715-02
* Solaris 10 with patch 121230-02 or later
Change History
24-Apr-2007:
* Updated Contributing Factors and Resolution sections
23-Jul-2007:
* Updated Resolution section
09-Nov-2007:
* Update Impact, Contributing Factors, Relief/Workaround, and
Resolution
* State: Resolved
This Sun Alert notification is being provided to you on an "AS IS"
basis. This Sun Alert notification may contain information provided by
third parties. The issues described in this Sun Alert notification may
or may not impact your system(s). Sun makes no representations,
warranties, or guarantees as to the information contained herein. ANY
AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION
WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT
YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE
OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN.
This Sun Alert notification contains Sun proprietary and confidential
information. It is being provided to you pursuant to the provisions of
your agreement to purchase services from Sun, or, if you do not have
such an agreement, the Sun.com Terms of Use. This Sun Alert
notification may only be used for the purposes contemplated by these
agreements.
Copyright 2000-2006 Sun Microsystems, Inc., 4150 Network Circle, Santa
Clara, CA 95054 U.S.A. All rights reserved
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBRzp9Cyh9+71yA2DNAQJi8AP+N0ZGF8LOmciXvKrBJ3tONOKl6ffVdB/5
P3q5jrdJnSyDXo81EzinupVwKVO4IPd0BuVGKb7TGRNkq1yF084uMrRiTSFVSAeP
5sBGPudhPh/oOhjm+XzShMptbojt+nGUT3+HBfXFbxgFqhvI4wvMU1h9hw0bnnK6
k0LC7KCs7fA=
=6KP8
-----END PGP SIGNATURE-----