X509 certificate verification problem

[Jerry Zhang]

When using OpenSSL, one needs to follow a certain process to ensure the verification of the certificate is successful. But we believe that p3scan didn't follow the correct process of verifying X509 certificate which makes certain attacks possible.

We found the vulnerability by static analysis, typically, a process of verfication involves calling a chain of API, and we can deduce whether the communication process is vulnerable by detecting whether the process satisfies a certain relation.
The result format is like this:
notice: Line Number@Method Name, Source File

We provide this result to help developers to locate the problem faster.

This is the result for p3scan:
PDG]SSL_create_conn
 [Found]SSL_connect()
 [HASH] 368837387 [LineNo]@ 295[Kind]call-site[Char] SSL_connect()[Src] /home/roca/workspace/codebase/code/ubuntu_pkg/p3scan/p3scan-2.3.2/getline_ssl.c
 [Warning] SSL_new() not found!

We don't have a POC because we didn't succeed in configuring this software or don't know the way to verify the vulnerability. But through the analysis of the source code, we believe it breaks the ssl certificate verfication protocol.

for more information about the importance of checking hostname:
see http://people.stfx.ca/x2011/x2011ucj/SSL/p38-georgiev.pdf

Thanks.

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Launchpad Janitor (janitor)]

[Expired for p3scan (Ubuntu) because there has been no activity for 60 days.]