From b711f41d191a0252d15471da653f0e4a286ffa31 Mon Sep 17 00:00:00 2001 From: Asterisk Autobuilder Date: Wed, 8 Apr 2015 16:54:33 +0000 Subject: [PATCH] Merge changes for AST-2015-003 git-svn-id: https://origsvn.digium.com/svn/asterisk/tags/11.17.1@434387 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- ChangeLog | 25 +++++++++++++++++++++++++ main/tcptls.c | 10 ++++++++-- 2 files changed, 33 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index fd4872c1cb..f42f041c5d 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,28 @@ +2015-04-08 Asterisk Development Team + + * Asterisk 11.17.1 Released. + + * Mitigate MitM attack potential from certificate with NULL byte in CN. + + When registering to a SIP server with TLS, Asterisk will accept CA + signed certificates with a common name that was signed for a domain + other than the one requested if it contains a null character in the + common name portion of the cert. This patch fixes that by checking + that the common name length matches the the length of the content we + actually read from the common name segment. Some certificate + authorities automatically sign CA requests when the requesting CN + isn't already taken, so an attacker could potentially register a CN + with something like www.google.com\x00www.secretlyevil.net and have + their certificate signed and Asterisk would accept that certificate + as though it had been for www.google.com. + + ASTERISK-24847 #close + Reported by: Maciej Szmigiero + patches: + asterisk-null-in-cn.patch uploaded by mhej (license 6085) + + AST-2015-003 + 2015-04-01 Asterisk Development Team * Asterisk 11.17.0 Released. diff --git a/main/tcptls.c b/main/tcptls.c index a1d1ef72cf..9d9aefc0ba 100644 --- a/main/tcptls.c +++ b/main/tcptls.c @@ -639,9 +639,15 @@ static void *handle_tcptls_connection(void *data) break; } str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, pos)); - ASN1_STRING_to_UTF8(&str2, str); + ret = ASN1_STRING_to_UTF8(&str2, str); + if (ret < 0) { + continue; + } + if (str2) { - if (!strcasecmp(tcptls_session->parent->hostname, (char *) str2)) { + if (strlen((char *) str2) != ret) { + ast_log(LOG_WARNING, "Invalid certificate common name length (contains NULL bytes?)\n"); + } else if (!strcasecmp(tcptls_session->parent->hostname, (char *) str2)) { found = 1; } ast_debug(3, "SSL Common Name compare s1='%s' s2='%s'\n", tcptls_session->parent->hostname, str2);