386776 - (CVE-2007-3108) Placeholder for VU#724968 investigation

Status: RESOLVED INACTIVE

(NSS :: Libraries, defect, P3)

Description

[Daniel Veditz [:dveditz]]

Cert forwarded information about VU#724968 which is a flaw in a different crypto product but which they worry may also affect NSS. This is a placeholder while we investigate (nelsonb and rrelyea have the paper) in case we need to start tracking getting a fix into releases.

Comment 1

[Daniel Veditz [:dveditz]]

Cert sent an update, OpenSSL has fixed this in their implementation. Any information on whether we had the same issue in NSS?

- - - - - - 
Hello,

The OpenSSL team has released a patch for VU#724968 (CVE-2007-3108), and has made it publicly available here:
http://cvs.openssl.org/chngview?cn=16275

We have published vulnerability note VU#724968 (http://www.kb.cert.org/vuls/id/724968). If you send us a vendor statement, we will add it to the
note.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

OpenSSL patch was publicly published today.
CVE-2007-3108.txt">http://openssl.org/news/patch-CVE-2007-3108.txt

Comment 3

[Robert Relyea]

NSS has the same code that openSSL had, however the risk from the paper seems quite minimal. While it's good research and should be watched, It doesn't appear to create a threat at this point in time. In fact the paper couldn't even attack openSSL without modification.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

The paper reported a successful attack against a MODIFIED version of OpenSSL,
modified to call their branch prediction cache analyzer every so-many times
through the modular exponentiation loop.  This is not a very realistic threat.

Our threat model excludes all modifications to the running code.  That is,
we don't attempt to protect the user against attacks where the attacker is
running code IN THE SAME PROCESS on the user's system, with the user's 
credentials and access rights.  

Bob, NSS shares no code with OpenSSL, so let's be careful NOT to say it is 
"the same code".  It may be similar, but we need to be careful to say that
correctly.  

Comment 5

[Robert Relyea]

Nelson's correct, the more accurate statement is we are running the same type of algorithm that was attacked in the openSSL case.

Comment 6

[Josh Aas]

This seems low-risk and there is public information about it. Can we open this up, maybe resolve it?

Comment 7

[Robert Relyea]

I'm OK if Dan Veditz is OK. The described attack is low risk and public.