database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-04-29 13:56:47 +03:00
Code

Reject certificates with embedded NULLs in the commonName field. This stops

Browse Source 
attacks where an attacker would put <attack>\0<propername> in the field and
trick the validation code that the certificate was for <attack>.

This is a very low risk attack since it reuqires the attacker to trick the
CA into issuing a certificate with an incorrect field, and the common
PostgreSQL deployments are with private CAs, and not external ones. Also,
default mode in 8.4 does not do any name validation, and is thus also not
vulnerable - but the higher security modes are.

Backpatch all the way. Even though versions 8.3.x and before didn't have
certificate name validation support, they still exposed this field for
the user to perform the validation in the application code, and there
is no way to detect this problem through that API.

Security: CVE-2009-4034
This commit is contained in:
Magnus Hagander 2009-12-09 06:37:17 +00:00
parent 8510e7e463
commit d585483ab9
2 changed files with 44 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
src/backend/libpq/be-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.59.2.4 2009/01/28 15:06:52 mha Exp $ * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.59.2.5 2009/12/09 06:37:17 mha Exp $
* *
* Since the server static private key ($DataDir/server.key) * Since the server static private key ($DataDir/server.key)
* will normally be stored unencrypted so that the database * will normally be stored unencrypted so that the database
@ -899,9 +899,29 @@ aloop:
X509_NAME_oneline(X509_get_subject_name(port->peer), X509_NAME_oneline(X509_get_subject_name(port->peer),
port->peer_dn, sizeof(port->peer_dn)); port->peer_dn, sizeof(port->peer_dn));
port->peer_dn[sizeof(port->peer_dn) - 1] = '\0'; port->peer_dn[sizeof(port->peer_dn) - 1] = '\0';
X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer), r = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
NID_commonName, port->peer_cn, sizeof(port->peer_cn)); NID_commonName, port->peer_cn, sizeof(port->peer_cn));
port->peer_cn[sizeof(port->peer_cn) - 1] = '\0'; port->peer_cn[sizeof(port->peer_cn) - 1] = '\0';
if (r == -1)
{
/* Unable to get the CN, set it to blank so it can't be used */
port->peer_cn[0] = '\0';
}
else
{
/*
* Reject embedded NULLs in certificate common name to prevent attacks like
* CVE-2009-4034.
*/
if (r != strlen(port->peer_cn))
{
ereport(COMMERROR,
(errcode(ERRCODE_PROTOCOL_VIOLATION),
errmsg("SSL certificate's common name contains embedded null")));
close_SSL(port);
return -1;
}
}
} }
ereport(DEBUG2, ereport(DEBUG2,
(errmsg("SSL connection from \"%s\"", port->peer_cn))); (errmsg("SSL connection from \"%s\"", port->peer_cn)));

25
src/interfaces/libpq/fe-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.73.2.2 2009/01/28 15:06:53 mha Exp $ * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.73.2.3 2009/12/09 06:37:17 mha Exp $
* *
* NOTES * NOTES
* [ Most of these notes are wrong/obsolete, but perhaps not all ] * [ Most of these notes are wrong/obsolete, but perhaps not all ]
@ -1129,9 +1129,28 @@ open_client_SSL(PGconn *conn)
conn->peer_dn, sizeof(conn->peer_dn)); conn->peer_dn, sizeof(conn->peer_dn));
conn->peer_dn[sizeof(conn->peer_dn) - 1] = '\0'; conn->peer_dn[sizeof(conn->peer_dn) - 1] = '\0';
X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer), r = X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
NID_commonName, conn->peer_cn, SM_USER); NID_commonName, conn->peer_cn, SM_USER);
conn->peer_cn[SM_USER] = '\0'; conn->peer_cn[SM_USER] = '\0'; /* buffer is SM_USER+1 chars! */
if (r == -1)
{
/* Unable to get the CN, set it to blank so it can't be used */
conn->peer_cn[0] = '\0';
}
else
{
/*
* Reject embedded NULLs in certificate common name to prevent attacks like
* CVE-2009-4034.
*/
if (r != strlen(conn->peer_cn))
{
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("SSL certificate's common name contains embedded null\n"));
close_SSL(conn);
return PGRES_POLLING_FAILED;
}
}
/* verify that the common name resolves to peer */ /* verify that the common name resolves to peer */