nginx security advisory (CVE-2014-3616)

[Maxim Dounin]

Hello!

On Thu, Sep 18, 2014 at 07:18:28PM +1000, Matt Palmer wrote:

> On Thu, Sep 18, 2014 at 11:14:06AM +0300, Christos Trochalakis wrote:
> > Salvatore Bonaccorso (cc'd) of the Debian Security Team has prepared a
> > combined patch backporting the upstream commit and other bits needed
> > (ngx_ssl_certificate_index). He has uploaded the patch here:
> > 
> > https://people.debian.org/~carnil/tmp/nginx/nginx_1.2.1-2.2+wheezy3.debdiff
> > https://people.debian.org/~carnil/tmp/nginx/
> > 
> > We would appreciate it if someone could double-check the patch.
> 
> Yeah, that ain't going to fly.  The data behind ngx_ssl_certificate_index is
> never getting initialized.  Why don't you just use the patch I put together
> for the LTS upload I did a couple of days ago?

I haven't seen the patch you've prepared, but for 1.2.x and 1.4.x 
it should be better to avoid complexity introduced in the 
1.7.x/1.6.x and just use a random value for session id context, as 
there is no support for shared TLS Session Tickets.

Patch should be as trivial as:

--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1531,14 +1531,16 @@ ngx_int_t
 ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
     ssize_t builtin_session_cache, ngx_shm_zone_t *shm_zone, time_t timeout)
 {
-    long  cache_mode;
+    long    cache_mode;
+    u_char  buf[16];
 
     if (builtin_session_cache == NGX_SSL_NO_SCACHE) {
         SSL_CTX_set_session_cache_mode(ssl->ctx, SSL_SESS_CACHE_OFF);
         return NGX_OK;
     }
 
-    SSL_CTX_set_session_id_context(ssl->ctx, sess_ctx->data, sess_ctx->len);
+    RAND_pseudo_bytes(buf, 16);
+    SSL_CTX_set_session_id_context(ssl->ctx, buf, 16);
 
     if (builtin_session_cache == NGX_SSL_NONE_SCACHE) {
 
(Against stable-1.2 branch in nginx repo.)

Alternatively, trivial configuration-level workarounds can be 
used to avoid virtual host confusion if it can be important in a 
particular configuration, see the paper for details.

-- 
Maxim Dounin
http://nginx.org/