<!DOCTYPE HTML>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div id="body" style='font-family:"Helvetica Neue", Helvetica, Arial, sans-serif;font-size:16px;color:#808080;width:570px;margin:0 auto'>
<table class="repository" background="" style="padding:0px;border:0px;width:100%;color:#606060;font-size:20px;margin-bottom:15px;margin-top:15px;">
<tr style="padding:0px;border:0px;">
<td style="padding:0px;border:0px;vertical-align:middle">
<img src="https://avatars.githubusercontent.com/u/3279138?s=40&d=https%3A%2F%2Ftravis-ci.org%2Fimages%2Fmailer%2Fmascot-avatar-40px.png" style="vertical-align:middle;width:40px;height:40px"> <span style="vertical-align:middle;margin-left:3px"><strong><a href="https://travis-ci.org/openssl/openssl" style="text-decoration:underline;color:#606060">openssl / openssl</a></strong> (<a href="https://github.com/openssl/openssl/tree/OpenSSL_1_0_2-stable" style="text-decoration:underline;color:#606060">OpenSSL_1_0_2-stable</a>)</span>
</td>
</tr>
</table>
<div id="build" class="failure" style="border-radius:5px;padding:0px;width:570px;font-size:13px">
<div class="content">
<table style="padding:0px;border:0px;width:100%;border-spacing:0">
<thead>
<tr style="padding:0px;border:0px;font-weight:700;font-size:18px;background-color:#fdcdce;color:#df192a">
<td style="border:0px;padding:0px 20px 0px 0px;border-top:1px solid #808080;border-bottom:1px solid #adadad;width:50px;padding:0px;text-align:center;vertical-align:middle;padding-top:5px;border-left:1px solid #606060;border-top-left-radius:5px"><div class="status-image" style="width:25px;background-size:25px;height:30px;margin-left:15px;margin-top:0px;vertical-align:middle"><img src="https://travis-ci.org/images/mailer/failed.png" width="25" height="25"></div></td>
<td class="build-message" style="padding:0px;border:0px;padding:0px 20px 0px 0px;vertical-align:middle;border-top:1px solid #808080;border-bottom:1px solid #adadad">
<span style="display:inline-block;margin-top:12px;vertical-align:middle"><a href="https://travis-ci.org/openssl/openssl/builds/154104212" style="text-decoration:none;font-weight:bold;color:#57769d;text-decoration:underline;color:#df192a">Build #5640 is still failing.</a></span><img src="https://travis-ci.org/images/mailer/arrow-failed.png" style="float: right;" height="45">
</td>
<td align="right" class="time" style="padding:0px;border:0px;font-weight:normal;font-size:12px;padding:0px 20px 0px 0px;vertical-align:middle;border-top:1px solid #808080;border-bottom:1px solid #adadad;border-right:1px solid #606060;border-top-right-radius:5px">
<div class="stop-watch" style="vertical-align:middle;padding:0px;background-size:20px;display:inline-block;width:20px;height:20px"><img src="https://travis-ci.org/images/mailer/stopwatch-failed.png" width="20" height="20"></div> <span style="vertical-align:middle">19 minutes and 20 seconds</span>
</td>
</tr>
</thead>
<tbody style="margin-bottom:40px">
<tr style="padding:0px;border:0px">
<td class="profile-image" style="border:0px;padding:10px 20px 10px 0px;height:20px;width:50px;padding:0px;border-left:1px solid #adadad;padding-top:20px;padding-bottom:5px;text-align:center"><img src="https://secure.gravatar.com/avatar/10f7b441a32d5790efad9fc68cae4af2?s=15&d=https%3A%2F%2Ftravis-ci.org%2Fimages%2Fmailer%2Fmascot-avatar-15px.png"></td>
<td class="grey" style="padding:0px;border:0px;color:#808080;padding:10px 20px 10px 0px;height:20px;padding-top:20px;padding-bottom:5px"><strong>Matt Caswell</strong></td>
<td align="right" class="grey" style="padding:0px;border:0px;color:#808080;padding:10px 20px 10px 0px;height:20px;border-right:1px solid #adadad;padding-top:20px;padding-bottom:5px">
<a href="https://github.com/openssl/openssl/commit/20200681236059aee56f3a2270b27052d9ba559c" style="text-decoration:underline;text-decoration:none;font-weight:bold;color:#57769d">2020068</a> <a href="https://github.com/openssl/openssl/compare/0ee4f13bbaa4...202006812360" style="text-decoration:underline;text-decoration:none;font-weight:bold;color:#57769d">Changeset →</a>
</td>
</tr>
<tr style="padding:0px;border:0px">
<td style="border:0px;padding:10px 20px 10px 0px;height:20px;width:50px;padding:0px;border-left:1px solid #adadad;border-bottom-left-radius:5px;border-bottom:1px solid #adadad"> </td>
<td colspan="2" class="grey" style="padding:0px;border:0px;color:#808080;padding:10px 20px 10px 0px;height:20px;border-right:1px solid #adadad;padding-bottom:20px;padding-top:0px;border-bottom:1px solid #adadad;border-bottom-right-radius:5px">Prevent DTLS Finished message injection<br><br>Follow on from CVE-2016-2179<br><br>The investigation and analysis of CVE-2016-2179 highlighted a related flaw.<br><br>This commit fixes a security "near miss" in the buffered message handling<br>code. Ultimately this is not currently believed to be exploitable due to<br>the reasons outlined below, and therefore there is no CVE for this on its<br>own.<br><br>The issue this commit fixes is a MITM attack where the attacker can inject<br>a Finished message into the handshake. In the description below it is<br>assumed that the attacker injects the Finished message for the server to<br>receive it. The attack could work equally well the other way around (i.e<br>where the client receives the injected Finished message).<br><br>The MITM requires the following capabilities:<br>- The ability to manipulate the MTU that the client selects such that it<br>is small enough for the client to fragment Finished messages.<br>- The ability to selectively drop and modify records sent from the client<br>- The ability to inject its own records and send them to the server<br><br>The MITM forces the client to select a small MTU such that the client<br>will fragment the Finished message. Ideally for the attacker the first<br>fragment will contain all but the last byte of the Finished message,<br>with the second fragment containing the final byte.<br><br>During the handshake and prior to the client sending the CCS the MITM<br>injects a plaintext Finished message fragment to the server containing<br>all but the final byte of the Finished message. The message sequence<br>number should be the one expected to be used for the real Finished message.<br><br>OpenSSL will recognise that the received fragment is for the future and<br>will buffer it for later use.<br><br>After the client sends the CCS it then sends its own Finished message in<br>two fragments. The MITM causes the first of these fragments to be<br>dropped. The OpenSSL server will then receive the second of the fragments<br>and reassemble the complete Finished message consisting of the MITM<br>fragment and the final byte from the real client.<br><br>The advantage to the attacker in injecting a Finished message is that<br>this provides the capability to modify other handshake messages (e.g.<br>the ClientHello) undetected. A difficulty for the attacker is knowing in<br>advance what impact any of those changes might have on the final byte of<br>the handshake hash that is going to be sent in the "real" Finished<br>message. In the worst case for the attacker this means that only 1 in<br>256 of such injection attempts will succeed.<br><br>It may be possible in some situations for the attacker to improve this such<br>that all attempts succeed. For example if the handshake includes client<br>authentication then the final message flight sent by the client will<br>include a Certificate. Certificates are ASN.1 objects where the signed<br>portion is DER encoded. The non-signed portion could be BER encoded and so<br>the attacker could re-encode the certificate such that the hash for the<br>whole handshake comes to a different value. The certificate re-encoding<br>would not be detectable because only the non-signed portion is changed. As<br>this is the final flight of messages sent from the client the attacker<br>knows what the complete hanshake hash value will be that the client will<br>send - and therefore knows what the final byte will be. Through a process<br>of trial and error the attacker can re-encode the certificate until the<br>modified handhshake also has a hash with the same final byte. This means<br>that when the Finished message is verified by the server it will be<br>correct in all cases.<br><br>In practice the MITM would need to be able to perform the same attack<br>against both the client and the server. If the attack is only performed<br>against the server (say) then the server will not detect the modified<br>handshake, but the client will and will abort the connection.<br>Fortunately, although OpenSSL is vulnerable to Finished message<br>injection, it is not vulnerable if *both* client and server are OpenSSL.<br>The reason is that OpenSSL has a hard "floor" for a minimum MTU size<br>that it will never go below. This minimum means that a Finished message<br>will never be sent in a fragmented form and therefore the MITM does not<br>have one of its pre-requisites. Therefore this could only be exploited<br>if using OpenSSL and some other DTLS peer that had its own and separate<br>Finished message injection flaw.<br><br>The fix is to ensure buffered messages are cleared on epoch change.<br><br>Reviewed-by: Richard Levitte <levitte@openssl.org></td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="broadcasts" style="width:528px;padding:10px 20px;border:1px solid #adadad;border-radius:5px;font-size:12px;margin-bottom:0px;background-color:#FBFddc;margin-top:20px">
<span class="grey" style="color:#808080">
<b>System message:</b>
<p style="margin-top:5px;margin-bottom:0px">
We are seeing build failures due to new sudo-enabled Precise and Trusty images. See more details <a href="https://www.traviscistatus.com/incidents/11hp8bhkrkn7" style="text-decoration:underline">here</a>. Thank you for your enduring patience. </p>
</span>
</div>
<div style="padding-top: 10px; width: 570px">
<span>
<div class="section footnote" style="margin-top:20px;border-radius:5px;border:1px solid #adadad;font-size:12px;padding:10px 20px;width:528px">
<p class="grey" style="color:#808080;margin-top:0px;margin-bottom:5px"><strong style="font-size:14px">Want to know about upcoming build environment updates?</strong></p>
<p class="grey" style="color:#808080;margin-top:0px;margin-bottom:5px">Would you like to stay up-to-date with the upcoming Travis CI build environment updates?
We set up a mailing list for you!
Sign up <a href="http://eepurl.com/9OCsP" style="text-decoration:underline;color:#606060">here</a>.
</p>
</div>
</span>
</div>
<table border="0" class="footer" style="padding:0px;border:0px;width:100%;background-color:#e9e6e7;border-radius:5px;border:1px solid #adadad;padding:10px;margin-top:20px;font-size:12px;width:570px;line-height:16px">
<tr style="padding:0px;border:0px">
<td style="padding:0px;border:0px">
<img src="https://travis-ci.org/images/mailer/email-footer-travis-logo.png" style="width: 50px; height: 50px;">
</td>
<td style="padding:0px;border:0px;color:#808080;" class="grey">
<a href="https://docs.travis-ci.com" style="text-decoration:underline;color:#606060">Documentation</a> about Travis CI<br>
For help please join our IRC channel <a href="irc://irc.freenode.net/travis" style="text-decoration:underline;color:#606060">irc.freenode.net#travis</a>.<br>
Choose who receives these build notification emails in your <a href="https://docs.travis-ci.com/user/notifications" style="text-decoration:underline;color:#606060">configuration file</a>.
</td>
</tr>
</table>
<div style="padding-top: 10px; width: 570px">
<img id="mascot" src="https://travis-ci.org/images/mailer/travis-mascot.png" width="80" style="float:right;margin-top:10px;margin-right:20px">
<div class="section footnote" style="margin-top:20px;border-radius:5px;border:1px solid #adadad;font-size:12px;padding:10px 20px;width:528px">
<p class="grey" style="color:#808080;margin-top:0px;margin-bottom:5px"><strong style="font-size:14px">Would you like to test your private code?</strong></p>
<p class="grey" style="color:#808080;margin-top:0px;margin-bottom:5px"><a href="https://travis-ci.com?utm_source=build_email_footer&utm_campaign=travis-ci.org&utm_medium=email" style="text-decoration:underline;color:#606060">Travis CI for Private Projects</a> could be your new best friend!</p>
</div>
</div>
</div>
<script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"action": {
"@type": "ViewAction",
"url": "https://travis-ci.org/openssl/openssl/builds/154104212",
"name": "View Build"
},
"description": "View Build #5640 on Travis CI"
}
</script>
</body>
</html>