CVE-2011-4354: Medium severity openssl vulnerability
crypto/bn/bnnist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.
Other sources
It was reported that OpenSSL 0.9.8g (only in the 32-bit build) was vulnerable to a bug where, in extremely rare instances, the bug would cause incorrect computation of finite field operations when using NIST elliptic curves P-256 or P-384. This flaw could allow for the retrieval of a TLS server's private key. A paper was published [1] describing the attack.
There are some very specific pre-requisites for a successful attack:
- OpenSSL 0.9.8g (32-bit build) - use of NIST elliptic curve P-256 and/or P-384 - the use of ECDH family ciphers and/or the use of ECDHE family ciphers and the lack of SSLOPSINGLEECDHUSE context option
This bug is corrected in OpenSSL >= 0.9.8h and does not affect earlier versions of OpenSSL than 0.9.8g. A series of patches [2] fix this upstream (starting with r.1.15).
[1] http://eprint.iacr.org/2011/633 [2] http://cvs.openssl.org/rlog?f=openssl%2Fcrypto%2Fbn%2Fbnnist.c
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4354?
CVE-2011-4354 has been classified as a moderate severity vulnerability due to its potential impact on secure communications.
How do I fix CVE-2011-4354?
To fix CVE-2011-4354, upgrade OpenSSL to version 0.9.8h or later on affected systems.
What impact does CVE-2011-4354 have on affected systems?
CVE-2011-4354 might allow an attacker to exploit weaknesses in the ECDH and ECDHE cipher suites leading to compromised cryptographic keys.
Which OpenSSL versions are affected by CVE-2011-4354?
CVE-2011-4354 affects OpenSSL versions before 0.9.8h on 32-bit platforms.
In what products is CVE-2011-4354 known to be a vulnerability?
CVE-2011-4354 is known to affect products that utilize vulnerable versions of OpenSSL, including stunnel.