Bug 305343 – <net-ftp/proftpd-1.3.2d: TLS Session Renegotiation MITM (CVE-2009-3555)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Bernd Lommerzheim 2010-02-16 01:01:50 UTC]

Hello,
a few days ago ProFTPD 1.3.2d [1,2] (just a bugfix-release of the stable
ProFTPD 1.3.2) and ProFTPD 1.3.3rc4 [3,4] has been released.

As there are not big changes in ProFTPD 1.3.2d a copy of the
proftpd-1.3.2c.ebuild should work. Maybe we should bump mod_deflate to 0.5 in
proftpd_1.3.2d.ebuild.

Furthermore I will attach a ProFTPD 1.3.3rc4 ebuild patch (proftpd-1.3.3_rc4.ebuild.patch against proftpd-1.3.3_rc3-r1.ebuild) and the proftpd.initd which have the following changes:
* Update mod_deflate to 0.5.
* Remove redundant patch.
* Some code style changes.
* Rename proftpd.rc7 to proftpd.initd with some changes:
  * Update "use" dependencies. Fixes Gentoo Bug #301266.
  * Add existent check of /var/run/proftpd. If this needed directory is missing (e.g. if /var/run is a tmpfs) create it. Fixes Gentoo Bug #301264.
  * Small code style changes.

Best regards.
Bernd Lommerzheim

[1] http://proftpd.org/docs/RELEASE_NOTES-1.3.2d
[2] http://proftpd.org/docs/NEWS-1.3.2d
[3] http://proftpd.org/docs/RELEASE_NOTES-1.3.3rc4
[4] http://proftpd.org/docs/NEWS-1.3.3rc4

[Comment 1 Bernd Lommerzheim 2010-02-16 01:02:38 UTC]

Created attachment 219843 [details, diff]
proftpd-1.3.3_rc4.ebuild (patch against proftpd-1.3.3_rc3-r1.ebuild)

[Comment 2 Bernd Lommerzheim 2010-02-16 01:03:16 UTC]

Created attachment 219845 [details]
proftpd.initd (replaces proftpd.rc7)

[Comment 3 Bernd Lommerzheim 2010-02-16 13:12:57 UTC]

Created attachment 219893 [details]
proftpd.initd (replaces proftpd.rc7)

[Comment 4 Jeroen Roovers (RETIRED) 2010-02-16 17:07:12 UTC]

The previous version bump (bug #295545) missed this bit:

1.3.2c (maintenance)
---------------------

  + Added Taiwan translation.

  + Added a workaround in mod_tls to deal with the vulnerability found in
    SSL/TLS protocol during renegotiation (CVE-2009-3555).  Good
    descriptions of this vulnerability can be found here:
  
      http://extendedsubset.com/?p=8 
      http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html

    The workaround implemented in mod_tls (Bug#3324) is one of the suggested
    mitigation approaches: the server now refuses all client-initiated
    SSL/TLS session renegotiations.


and the latest release adds this:


1.3.2d (maintenance)
---------------------

  + Fixed mod_tls compilation when using OpenSSL versions older than 0.9.7.

[Comment 5 Bernd Lommerzheim 2010-02-16 17:29:27 UTC]

I think we should add ProFTPD 1.3.2d to the portage tree and start a stabilization request for it. Although it does not directly fix a security issue it solves some segfaults and compatibility problems.

[Comment 6 Bernard Cafarelli 2010-02-17 12:29:30 UTC]

Ok, 1.3.3_rc4 added in tree with your changes, thanks Bernd!

I've also added 1.3.2d as as simple copy of 1.3.2c, to keep minimal changes for testing. Thanks Jer for spotting the security issue, recommend 1.3.2d stable round then, target arches: alpha amd64 hppa ppc ppc64 sparc x86

[Comment 7 Matus UHLAR - fantomas 2010-03-01 14:54:04 UTC]

obsolete by bug 307075

[Comment 8 Alex Legler (RETIRED) 2010-03-05 07:51:01 UTC]

Arches, please test and mark stable:
=net-ftp/proftpd-1.3.2d
Target keywords : "alpha amd64 hppa ppc ppc64 sparc x86"

[Comment 9 Christian Faulhammer (RETIRED) 2010-03-05 12:25:06 UTC]

x86 stable

[Comment 10 Markus Meier 2010-03-07 15:04:32 UTC]

amd64 stable

[Comment 11 Brent Baude (RETIRED) 2010-03-08 18:37:55 UTC]

ppc64 done

[Comment 12 Joe Jezak (RETIRED) 2010-03-09 22:42:25 UTC]

Marked ppc stable.

[Comment 13 Jeroen Roovers (RETIRED) 2010-03-12 05:31:24 UTC]

Stable for HPPA.

[Comment 14 Raúl Porcel (RETIRED) 2010-03-13 17:29:29 UTC]

alpha/sparc stable

[Comment 15 Tim Sammut (RETIRED) 2010-11-19 18:32:48 UTC]

GLSA with 343389.

[Comment 16 GLSAMaker/CVETool Bot 2012-10-20 00:29:57 UTC]

CVE-2009-3555 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3555):
  The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in
  Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache
  HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and
  earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier,
  multiple Cisco products, and other products, does not properly associate
  renegotiation handshakes with an existing connection, which allows
  man-in-the-middle attackers to insert data into HTTPS sessions, and possibly
  other types of sessions protected by TLS or SSL, by sending an
  unauthenticated request that is processed retroactively by a server in a
  post-renegotiation context, related to a "plaintext injection" attack, aka
  the "Project Mogul" issue.

[Comment 17 GLSAMaker/CVETool Bot 2013-09-24 23:39:18 UTC]

This issue was resolved and addressed in
 GLSA 201309-15 at http://security.gentoo.org/glsa/glsa-201309-15.xml
by GLSA coordinator Sean Amoss (ackle).