[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Flaw in mariadb clients SSL certificate validation
From:       Sergei Golubchik <serg () mariadb ! org>
Date:       2016-01-26 8:05:46
Message-ID: 20160126080546.GA27464 () meddwl
[Download RAW message or body]

Hi,

MariaDB (as well as MySQL and Percona Server) has an option to validate
server certificate, when establishing an SSL connection. It checks that
the certificate belongs to the host that the client wants to connect to.
This validation, of course, should normally always be enabled to prevent
MITM attacks.

Recently (end of November) two security researchers Paul Kehrer and Alex
Gaynor have found a flaw in this certificate validation code that allows
to trick it into accepting certificate from other hosts. For example,
if the host 'foo.com' has a certificate with the "Organizational Unit"
being, say, "/CN=bar.com", then MariaDB client will see the result as

   /OU=/CN=bar.com/CN=foo.com

and will think that this certificate belongs to bar.com. This bugs is in
15 year old code and is present in all MariaDB/MySQL/Percona Server
versions. 

This vulnerability got CVE-2016-2047.

It is fixed in MariaDB 5.5.47, MariaDB 10.0.23, MariaDB 10.1.10
(all released in December).

Regards,
Sergei
Chief Architect MariaDB
and security@mariadb.org
[prev in list] [next in list] [prev in thread] [next in thread]