[asterisk-commits] jrose: branch 12 r434356 - in /branches/12: ./ main/tcptls.c

[SVN commits to the Asterisk project]

Author: jrose
Date: Wed Apr  8 11:22:47 2015
New Revision: 434356

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=434356
Log:
Security/tcptls: MitM Attack potential from certificate with NULL byte in CN.

When registering to a SIP server with TLS, Asterisk will accept CA signed
certificates with a common name that was signed for a domain other than the
one requested if it contains a null character in the common name portion of
the cert. This patch fixes that by checking that the common name length
matches the the length of the content we actually read from the common name
segment. Some certificate authorities automatically sign CA requests when
the requesting CN isn't already taken, so an attacker could potentially
register a CN with something like www.google.com\x00www.secretlyevil.net
and have their certificate signed and Asterisk would accept that certificate
as though it had been for www.google.com - this is a security fix and is
noted in AST-2015-003.

ASTERISK-24847 #close
Reported by: Maciej Szmigiero
Patches:
 asterisk-null-in-cn.patch submitted by mhej (license 6085)
........

Merged revisions 434337 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 434338 from http://svn.asterisk.org/svn/asterisk/branches/11

Modified:
    branches/12/   (props changed)
    branches/12/main/tcptls.c

Propchange: branches/12/
------------------------------------------------------------------------------
Binary property 'branch-11-merged' - no diff available.

Modified: branches/12/main/tcptls.c
URL: http://svnview.digium.com/svn/asterisk/branches/12/main/tcptls.c?view=diff&rev=434356&r1=434355&r2=434356
==============================================================================
--- branches/12/main/tcptls.c (original)
+++ branches/12/main/tcptls.c Wed Apr  8 11:22:47 2015
@@ -640,9 +640,15 @@
 							break;
 						}
 						str = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(name, pos));
-						ASN1_STRING_to_UTF8(&str2, str);
+						ret = ASN1_STRING_to_UTF8(&str2, str);
+						if (ret < 0) {
+							continue;
+						}
+
 						if (str2) {
-							if (!strcasecmp(tcptls_session->parent->hostname, (char *) str2)) {
+							if (strlen((char *) str2) != ret) {
+								ast_log(LOG_WARNING, "Invalid certificate common name length (contains NULL bytes?)\n");
+							} else if (!strcasecmp(tcptls_session->parent->hostname, (char *) str2)) {
 								found = 1;
 							}
 							ast_debug(3, "SSL Common Name compare s1='%s' s2='%s'\n", tcptls_session->parent->hostname, str2);