BID:676

Multiple Vendor PKCS#1 Vulnerability

Info

Multiple Vendor PKCS#1 Vulnerability

Bugtraq ID:	676
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Jun 26 1998 12:00AM
Updated:	Jun 26 1998 12:00AM
Credit:	The vulnerability was discovered by Daniel Bleichenbacher <[email protected]> of Bell Labs.
Vulnerable:	SSLeay SSLeay 0.9 SSLeay SSLeay 0.8.1 SSLeay SSLeay 0.6.6 Open Market Secure WebServer 2.1 Netscape Proxy Server 3.5.1 Netscape Proxy Server 3.5 SP1 Netscape Proxy Server 2.5 SP4 Netscape Messaging Server 3.54 Netscape FastTrack Server 3.0.1 B Netscape FastTrack Server 2.0.1 C Netscape Enterprise Server 3.51 - Digital UNIX 4.0 D - HP HP-UX 10.10 - IBM AIX 4.1.5 - Microsoft Windows NT 4.0 - SGI IRIX 6.2 - Sun Solaris 2.5.1 Netscape Enterprise Server 3.0.1 B Netscape Enterprise Server 3.0 L Netscape Enterprise Server 2.0.1 C Netscape Directory Server 3.12 Netscape Directory Server 3.1 P1 Netscape Directory Server 1.3 P5 Netscape Collabra Server 3.5.2 Netscape Certificate Server 1.0 P1 Microsoft Site Server Commerce Edition 3.0 i386 + Hancom Hancom Office 2007 0 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 + Microsoft Commercial Internet System 2.0 + Microsoft Site Server Commerce Edition 3.0 alpha - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 Microsoft Site Server Commerce Edition 3.0 alpha - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft IIS 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 Microsoft Site Server 3.0 i386 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft IIS 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6a - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP6 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP5 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP4 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP3 - Microsoft Windows NT Enterprise Server 4.0 SP2 - Microsoft Windows NT Enterprise Server 4.0 SP1 - Microsoft Windows NT Enterprise Server 4.0 - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6a - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP6 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP5 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP4 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP3 - Microsoft Windows NT Server 4.0 SP2 - Microsoft Windows NT Server 4.0 SP1 - Microsoft Windows NT Server 4.0 Microsoft IIS 4.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Building Broadband Service Manager (BBSM) 5.0 + Cisco Call Manager 3.0 + Cisco Call Manager 3.0 + Cisco Call Manager 2.0 + Cisco Call Manager 2.0 + Cisco Call Manager 1.0 + Cisco Call Manager 1.0 + Cisco ICS 7750 + Cisco ICS 7750 + Cisco IP/VC 3540 Video Rate Matching Module + Cisco IP/VC 3540 Video Rate Matching Module + Cisco Unity Server 2.4 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.2 + Cisco Unity Server 2.0 + Cisco Unity Server 2.0 + Cisco uOne 4.0 + Cisco uOne 4.0 + Cisco uOne 3.0 + Cisco uOne 3.0 + Cisco uOne 2.0 + Cisco uOne 2.0 + Cisco uOne 1.0 + Cisco uOne 1.0 + Hancom Hancom Office 2007 0 + Hancom Hancom Office 2007 0 + Microsoft BackOffice 4.5 + Microsoft BackOffice 4.5 + Microsoft Windows NT 4.0 Option Pack + Microsoft Windows NT 4.0 Option Pack Microsoft IIS 3.0 - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.5 - Microsoft BackOffice 4.5 - Microsoft BackOffice 4.5 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 Microsoft Exchange Server 5.0 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 C2Net StrongHold Web Server 2.3 C2Net StrongHold Web Server 2.2 C2Net StrongHold Web Server 2.0.1

Not Vulnerable:	Netscape Messaging Server 3.55 Netscape Enterprise Server 3.6 SP2 Netscape Enterprise Server 3.6 - Compaq Tru64 4.0 d - Digital UNIX 4.0 B - HP HP-UX 11.0 - IBM AIX 4.2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 - SGI IRIX 6.5 - SGI IRIX 6.2 - Sun Solaris 2.5.1 - Sun Solaris 8_sparc - Sun Solaris 7.0 - Sun Solaris 2.6 Microsoft Windows NT 4.0 SP5 + Microsoft Windows NT Enterprise Server 4.0 SP5 + Microsoft Windows NT Enterprise Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Terminal Server 4.0 SP5 + Microsoft Windows NT Workstation 4.0 SP5 + Microsoft Windows NT Workstation 4.0 SP5 Microsoft Windows NT 4.0 SP4 + Microsoft Windows NT Enterprise Server 4.0 SP4 + Microsoft Windows NT Enterprise Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Terminal Server 4.0 SP4 + Microsoft Windows NT Workstation 4.0 SP4 + Microsoft Windows NT Workstation 4.0 SP4

Exploit / POC

Multiple Vendor PKCS#1 Vulnerability

x

Solution / Fix

Multiple Vendor PKCS#1 Vulnerability

Solution:
Vendors of SSL enabled servers have supplied patches for their respective servers. A number of references have been cited below, otherwise contact your vendor.

Microsoft: http://support.microsoft.com/support/kb/articles/q148/4/27.asp
Netscape: http://help.netscape.com/products/servers/ssldiscovery/index.html
SSLeay: http://www.ssleay.org/announce/pkcs1.html
Open Market: http://www.openmarket.com/security
C2Net: http://www.c2net.org

Microsoft IIS 4.0

Microsoft Generic SSL (PCT/TLS) Updates for IIS and Microsoft Internet Products (Q148427)
http://support.microsoft.com/default.aspx?scid=kb;en-us;148427&sd=tech

Microsoft Site Server Commerce Edition 3.0 i386

Microsoft Generic SSL (PCT/TLS) Updates for IIS and Microsoft Internet Products (Q148427)
http://support.microsoft.com/default.aspx?scid=kb;en-us;148427&sd=tech

Microsoft IIS 3.0

Microsoft Generic SSL (PCT/TLS) Updates for IIS and Microsoft Internet Products (Q148427)
http://support.microsoft.com/default.aspx?scid=kb;en-us;148427&sd=tech

Microsoft Exchange Server 5.5

Microsoft Generic SSL (PCT/TLS) Updates for IIS and Microsoft Internet Products (Q148427)
http://support.microsoft.com/default.aspx?scid=kb;en-us;148427&sd=tech

Microsoft Site Server 3.0 i386

Microsoft Generic SSL (PCT/TLS) Updates for IIS and Microsoft Internet Products (Q148427)
http://support.microsoft.com/default.aspx?scid=kb;en-us;148427&sd=tech

Microsoft Exchange Server 5.0

Microsoft Generic SSL (PCT/TLS) Updates for IIS and Microsoft Internet Products (Q148427)
http://support.microsoft.com/default.aspx?scid=kb;en-us;148427&sd=tech