diff options
author | simon <simon@FreeBSD.org> | 2009-01-07 20:17:55 +0000 |
---|---|---|
committer | simon <simon@FreeBSD.org> | 2009-01-07 20:17:55 +0000 |
commit | abe6016909259942e4406e3f1ad00457ed92ad7b (patch) | |
tree | 35047b128f79f0cc0e19f739b1989b690c953007 /crypto/openssl/apps | |
parent | ef24bb1a20fff74f45c2d0daf8a10d11d47251a4 (diff) | |
download | FreeBSD-src-abe6016909259942e4406e3f1ad00457ed92ad7b.zip FreeBSD-src-abe6016909259942e4406e3f1ad00457ed92ad7b.tar.gz |
Prevent cross-site forgery attacks on lukemftpd(8) due to splitting
long commands into multiple requests. [09:01]
Fix incorrect OpenSSL checks for malformed signatures due to invalid
check of return value from EVP_VerifyFinal(), DSA_verify, and
DSA_do_verify. [09:02]
Security: FreeBSD-SA-09:01.lukemftpd
Security: FreeBSD-SA-09:02.openssl
Obtained from: NetBSD [SA-09:01]
Obtained from: OpenSSL Project [SA-09:02]
Approved by: so (simon)
Diffstat (limited to 'crypto/openssl/apps')
-rw-r--r-- | crypto/openssl/apps/speed.c | 2 | ||||
-rw-r--r-- | crypto/openssl/apps/spkac.c | 2 | ||||
-rw-r--r-- | crypto/openssl/apps/verify.c | 3 | ||||
-rw-r--r-- | crypto/openssl/apps/x509.c | 2 |
4 files changed, 4 insertions, 5 deletions
diff --git a/crypto/openssl/apps/speed.c b/crypto/openssl/apps/speed.c index 7858aee..4af171d 100644 --- a/crypto/openssl/apps/speed.c +++ b/crypto/openssl/apps/speed.c @@ -2038,7 +2038,7 @@ int MAIN(int argc, char **argv) { ret=RSA_verify(NID_md5_sha1, buf,36, buf2, rsa_num, rsa_key[j]); - if (ret == 0) + if (ret <= 0) { BIO_printf(bio_err, "RSA verify failure\n"); diff --git a/crypto/openssl/apps/spkac.c b/crypto/openssl/apps/spkac.c index 0191d0a..01fe406 100644 --- a/crypto/openssl/apps/spkac.c +++ b/crypto/openssl/apps/spkac.c @@ -285,7 +285,7 @@ bad: pkey = NETSCAPE_SPKI_get_pubkey(spki); if(verify) { i = NETSCAPE_SPKI_verify(spki, pkey); - if(i) BIO_printf(bio_err, "Signature OK\n"); + if (i > 0) BIO_printf(bio_err, "Signature OK\n"); else { BIO_printf(bio_err, "Signature Failure\n"); ERR_print_errors(bio_err); diff --git a/crypto/openssl/apps/verify.c b/crypto/openssl/apps/verify.c index 9ff32cb..20cc9e3 100644 --- a/crypto/openssl/apps/verify.c +++ b/crypto/openssl/apps/verify.c @@ -266,7 +266,7 @@ static int check(X509_STORE *ctx, char *file, STACK_OF(X509) *uchain, STACK_OF(X ret=0; end: - if (i) + if (i > 0) { fprintf(stdout,"OK\n"); ret=1; @@ -367,4 +367,3 @@ static int MS_CALLBACK cb(int ok, X509_STORE_CTX *ctx) ERR_clear_error(); return(ok); } - diff --git a/crypto/openssl/apps/x509.c b/crypto/openssl/apps/x509.c index 5f61eb5..f0fa9d7 100644 --- a/crypto/openssl/apps/x509.c +++ b/crypto/openssl/apps/x509.c @@ -1144,7 +1144,7 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest, /* NOTE: this certificate can/should be self signed, unless it was * a certificate request in which case it is not. */ X509_STORE_CTX_set_cert(&xsc,x); - if (!reqfile && !X509_verify_cert(&xsc)) + if (!reqfile && X509_verify_cert(&xsc) <= 0) goto end; if (!X509_check_private_key(xca,pkey)) |