CVE-2008-0021

Related Files

Open Source CERT Security Advisory 2008.16

Posted Jan 7, 2009

Authored by Will Drewry, Open Source CERT | Site ocert.org

Several functions inside the OpenSSL library incorrectly check the result after calling the EVP_VerifyFinal function. This bug allows a malformed signature to be treated as a good signature rather than as an error. This issue affects the signature checks on DSA and ECDSA keys used with SSL/TLS. The flaw may be exploited by a malicious server or a man-in-the-middle attack that presents a malformed SSL/TLS signature from a certificate chain to a vulnerable client, bypassing validation.

tags | advisory

advisories | CVE-2008-5077, CVE-2008-0021, CVE-2008-0025

SHA-256 | f5724c1eba1778218b03f1b5af75356b08e95a08bbe2b92274df7f31dea9d59a

Download | Favorite | View