Executive Summary

This vulnerability involves Cryptographic Message Services (CMS) processing in OpenSSL failing to properly validate input fields related to cipher and tag lengths in AuthEnvelopedData containers.

Because of this, attackers can exploit the flaw to bypass integrity checks or gain key-equivalent functionality for a CMS recipient.

For example, an attacker can send a CMS message specifying a non-AEAD cipher, which OpenSSL incorrectly accepts and attempts to decrypt.

Another attack involves an on-path attacker capturing a legitimate AES-GCM AuthEnvelopedData message and replaying it with modifications that cause the victim to decrypt using AES-256-OFB, an unauthenticated mode, bypassing integrity validation.

Additionally, attackers can reduce the authentication tag length to a single byte, enabling brute force attacks to bypass integrity checks in applications relying on CMS_decrypt() to reject tampered content.

Notably, FIPS modules are not affected by this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious security impacts including:

• Attackers may achieve key-equivalent functionality for a CMS recipient, effectively allowing them to decrypt or manipulate messages as if they had the recipient's key.
• Attackers can bypass integrity validation, meaning they can alter encrypted messages without detection.
• On-path attackers can replay and modify captured messages to force the victim to decrypt using insecure cipher modes, potentially exposing sensitive data.
• Applications that rely on CMS_decrypt() to verify message integrity may be vulnerable to brute force attacks due to reduced tag length, leading to unauthorized data access or manipulation.

Useful 0 Not Useful 0