CVE-2014-0092: "Sky falling. Film at 11."
GnuTLS, the widely-used open-source encryption library, has a simply horrible bug. And it's had that bug since 2003. It has a similar effect to the recently-discovered one in Apple OS code: It fails to correctly validate certificates.
The conspiracy theorists are beginning to have a field day, with fingers pointing in the NSA's direction.
In IT Blogwatch, bloggers don their tinfoil hats.
Your humble blogwatcher curated these bloggy bits for your entertainment.
Serdar Yegulalp is... easy for you to say: [You're fired -Ed.]
The GnuTLS library, used in a great deal of software...has been revealed to have a bug that could allow an attacker to steal data. ... [It] involves GnuTLS's validation of X.509 certificates....
In an unpleasant echo of Apple's recent..."goto fail" [flaw] the bug took advantage of certain error handling checks in the code that were terminated too early. MORE
Dan Goodin broke the story:
[It's] an extremely critical vulnerability in a widely used cryptographic code library. [It] makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections. ... Initial estimates...indicate that more than 200 different operating systems or applications rely on GnuTLS...but it wouldn't be surprising if the actual number is much higher....
Attackers can exploit the error by presenting...a fraudulent certificate that is never rejected, despite its failure to pass routine security checks. ... Assume the severity is critical given the dizzying amount of downstream code that may be affected. MORE
Ironically, Nikos Mavrogiannopoulos first discovered the bug... In, err, code that he himself committed in 2003:
Users of GnuTLS are advised to upgrade to...updated packages [that] correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted. MORE
Your humble blogwatcher dreamed bad dreams:
Wow....
Looks like the NSA broke the cert verification of GnuTLS, too -- not just MacOS/iOS. MORE
So Redditers analyze thuswise:
flamingcow: I have been couching all my statements about the Apple one being intentionally planted...with careful words because I wanted to be realistic...and didn't want to seem like a...conspiracy crank. I think I'll stop pulling punches now. This **** was intentional. ... I just dug through the GnuTLS source history. ... This bug has been there since at least 2005....
nephros: the 2005 commit looks to be just coding style fixes, the goto cleanup had been there previously....
intvnut: The patch adds a label, and the code at the new label sets 'result = 0'. ... There was a mismatch between how result was being used in the body of the code (-1 indicates a negative response) and how the function itself was expected to return its result (true/false). A -1 indicates failure, but would look like 'true' to code expecting true/false....
takatori: NSA is all "dang, they found another one..." MORE
Meanwhile, AJ Lee trolls the OSS-fanbois:
Further proof that open source is not a security panacea. You still have to be reading and understand all the code. MORE
And Phil Winstanley makes like a certain chick:
There is a time bomb of security scares waiting to happen when people realise no mobile apps verify their certs. MORE
Computerworld Blogs Newsletter
Subscribe now to the Blogs Newsletter for a daily summary of the most recent and relevant blog posts at Computerworld.