Updated OpenSSL packages that fix potential timing-based and modified Bleichenbacher attacks are available for Red Hat Linux on IBM iSeries and pSeries systems.
OpenSSL is a commercial-grade, full-featured, and open source toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. In a paper, Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin Vuagnoux describe and demonstrate a timing-based attack on CBC ciphersuites in SSL and TLS. An active attacker may be able to use timing observations to distinguish between two different error cases: cipher padding errors and MAC verification errors. Over multiple connections this can leak sufficient information to make it possible to retrieve the plaintext of a common, fixed block. In order for an attack to be sucessful, an attacker must be able to act as a man-in-the-middle to intercept and modify multiple connections, which all involve a common fixed plaintext block (such as a password), and have good network conditions that allow small changes in timing to be reliably observed. Researchers discovered a timing attack on RSA keys. Applications making use of OpenSSL are generally vulnerable to such an attack, unless RSA blinding has been turned on. OpenSSL does not use RSA blinding by default and most applications do not enable RSA blinding. A local or remote attacker could use this attack to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction, and (2) the use of different integer multiplication algorithms ("Karatsuba" and normal). In order for an attack to be sucessful, an attacker must have good network conditions allowing small changes in timing to be reliably observed. Additionally, the SSL and TLS components for OpenSSL allow remote attackers to perform an unauthorized RSA private key operation via a modified Bleichenbacher attack. This attack uses a large number of SSL or TLS connections, using PKCS #1 v1.5 padding, and causes OpenSSL to leak information regarding the relationship between ciphertext and the associated plaintext, aka the "Klima-Pokorny-Rosa attack." These erratum packages contain patches provided by the OpenSSL group that enable RSA blinding by default and protect against the other vulnerabilities. Because server applications are affected by these vulnerabilities, users are advised to restart all services that use OpenSSL functionality, or reboot their systems after installing these updates.