OpenSSL Fixes Six Flaws in the Secure Sockets Layer Protocol Tool
OpenSSL has fixed six security vulnerabilities and updated both 1.0.0 and 0.9.8 versions of the open-source implementation of the Secure Sockets Layer protocol.
The vulnerabilities fixed in versions 1.0.0.f and 0.9.8s include a plain text recovery attack that is publicly known, policy check failures and problems with buffers not being cleared before being reused, according to a security advisory released Jan. 4 on OpenSSL.org . Four of the flaws affect both versions, according to the advisory.
The most serious flaw, if exploited, could enable an efficient plain text recovery attack against the OpenSSL implementation of Datagram Transport Layer Security (DTLS) protocol, which protects server-client communications from tampering or forgery. The issue was discovered and publicized recently by Nadhem Alfardan and Kenny Paterson, security researchers from the Information Security Group at Royal Holloway at the University of London. The cipher-block chaining-based encryption weakness allows adversaries to exploit timing differences that arise during decryption processing and recover the plain text version of an encrypted message without needing the initial encryption key.