Re: [jetty-user] "CVE-2009-3555 Prevent SSL renegotiate for SSL vulnerability" not fixed?
Jan Bartel <[email protected]>
| Newsgroups | gmane.comp.java.jetty.support |
|---|---|
| Organization | Webtide |
| Message-ID | <[email protected]> |
Brett,
jre 1.6u19 contained a patch that turned off renegotiation
at the level of the jsse impl by default:
http://www.oracle.com/technetwork/java/javase/6u19-141078.html
Here's the readme on the patch:
http://java.sun.com/javase/javaseforbusiness/docs/TLSReadme.html
So if you're using 1.6u20 that patch should be there in the jvm
anyway.
I just tested jetty-6.1.22 and found that the renegotiate was
disallowed as expected (I'm using 6.1u20 on linux).
Here's the client side trace:
[332] openssl s_client -connect localhost:8444
CONNECTED(00000003)
depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting Pty
Ltd/OU=Jetty/CN=jetty.mortbay.org
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting Pty
Ltd/OU=Jetty/CN=jetty.mortbay.org
verify return:1
---
Certificate chain
0 s:/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting Pty
Ltd/OU=Jetty/CN=jetty.mortbay.org
i:/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting Pty
Ltd/OU=Jetty/CN=jetty.mortbay.org
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIChDCCAe0CBEkTw/QwDQYJKoZIhvcNAQEEBQAwgYgxEDAOBgNVBAYTB1Vua25v
d24xEDAOBgNVBAgTB1Vua25vd24xEDAOBgNVBAcTB1Vua25vd24xJDAiBgNVBAoT
G01vcnQgQmF5IENvbnN1bHRpbmcgUHR5IEx0ZDEOMAwGA1UECxMFSmV0dHkxGjAY
BgNVBAMTEWpldHR5Lm1vcnRiYXkub3JnMB4XDTA4MTEwNzA0MjgzNloXDTM2MDMy
NTA0MjgzNlowgYgxEDAOBgNVBAYTB1Vua25vd24xEDAOBgNVBAgTB1Vua25vd24x
EDAOBgNVBAcTB1Vua25vd24xJDAiBgNVBAoTG01vcnQgQmF5IENvbnN1bHRpbmcg
UHR5IEx0ZDEOMAwGA1UECxMFSmV0dHkxGjAYBgNVBAMTEWpldHR5Lm1vcnRiYXku
b3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCD4eENLeMZJV081zdlQG+O
6+Z+4nQLqaeAkzRIYU+pUu9IgPgPIuPtJUhB1gKIL3fY5dx+0r0nK99EDOIngtCQ
hkjsBnPH/sqiqzuejz3eTrqlt/NASdK++IyXM1PQnLLmrxw+3upkS1J5o8TNtDUs
a3InDIj1B2NZiWbTfbMLcQIDAQABMA0GCSqGSIb3DQEBBAUAA4GBABR1O1E7N0v6
mndjReS0cX/sgqCUzR2N+4rleS7GExs5xjUTLWyJoEBooLGCPN/9nKy4cy6UirZO
0Z/z+ZxDkqBpw59hM+B27zZdyNUMvaxCaVkoDqhyq4yywIrXRH0eeF/yp+gyAIBP
Ioe6POoV7RhpiKGewnhElAUqSAVAz7hT
-----END CERTIFICATE-----
subject=/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting Pty
Ltd/OU=Jetty/CN=jetty.mortbay.org
issuer=/C=Unknown/ST=Unknown/L=Unknown/O=Mort Bay Consulting Pty
Ltd/OU=Jetty/CN=jetty.mortbay.org
---
No client certificate CA names sent
---
SSL handshake has read 1220 bytes and written 276 bytes
---
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
Protocol : TLSv1
Cipher : EDH-RSA-DES-CBC3-SHA
Session-ID:
4C89885FA68284FC09A5A2C7C782D2F2FAB661C01537DBA9E603C57D14A156AF
Session-ID-ctx:
Master-Key:
9D329E06B699ABC7E78668984501C0B7BD9C5932AFE0DE939E544F660B8FD7EB7E95F803D30741E14A1D2806FE8AA3EA
Key-Arg : None
Start Time: 1284081759
Timeout : 300 (sec)
Verify return code: 18 (self signed certificate)
---
HEAD / HTTP/1.0
R
RENEGOTIATING
8332:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
failure:s3_pkt.c:530:
And here's the server-side trace:
[212] java -jar start.jar etc/jetty.xml etc/jetty-sslengine.xml
2010-09-10 11:22:31.464:INFO::Logging to STDERR via
org.mortbay.log.StdErrLog
2010-09-10 11:22:31.690:INFO::jetty-6.1.22
2010-09-10 11:22:31.736:INFO::Deploy
/home/janb/src/jetty-6.1.22/contexts/javadoc.xml ->
org.mortbay.jetty.handler.ContextHandler@b6e39f{/javadoc,file:/home/janb/src/jetty-6.1.22/javadoc/}
2010-09-10 11:22:31.769:INFO::Deploy
/home/janb/src/jetty-6.1.22/contexts/test.xml ->
org.mortbay.jetty.webapp.WebAppContext@da4b71{/,/home/janb/src/jetty-6.1.22/webapps/test}
2010-09-10 11:22:31.897:INFO::Deploy
/home/janb/src/jetty-6.1.22/contexts/test-jndi.xml ->
org.mortbay.jetty.webapp.WebAppContext@1bf3d87{/test-jndi,/home/janb/src/jetty-6.1.22/contexts/test-jndi.d}
2010-09-10 11:22:32.345:INFO:/:Transparent AsyncProxyServlet @ /google
to http://www.google.com
2010-09-10 11:22:32.399:INFO::No Transaction manager found - if your
webapp requires one, please configure one.
2010-09-10 11:22:32.743:WARN::Unknown realm: Test JAAS Realm
2010-09-10 11:22:32.808:INFO::Opened
/home/janb/src/jetty-6.1.22/logs/2010_09_10.request.log
2010-09-10 11:22:32.813:INFO::Started [email protected]:8080
2010-09-10 11:22:33.297:INFO::Started
[email protected]:8444
2010-09-10 11:23:04.959:WARN::SSL renegotiate denied:
java.nio.channels.SocketChannel[connected local=/127.0.0.1:8444
remote=/127.0.0.1:50238]
Jan
Can you give more details about
On 09/09/10 16:56, Brett Wooldridge wrote:
> I am running on Java 1.6u20. Platforms are MacOS 10.6.4, Windows (all
> versions >= XP literally), and Linux (CentOS 5.2). However, the Java
> version should not be relavent because Jetty provided a fix to
> CVE-2009-3555 of it's own (ahead of Sun's fix) as seen in the release
> notes of Jetty 6.1.22.
>
> Regards,
> Brett
>
>
> On Thu, Sep 9, 2010 at 3:18 PM, Chris Haynes <[email protected]
> <mailto:[email protected]>> wrote:
>
> Brett,
>
> I'm not part of the Jetty team, nor am I an expert on this topic. I
> just suggest, for the sake of speed of response, that you let the
> team know exactly which version of Java your client's system is
> running on, since the SSL implementation is provided by Java, not by
> Jetty itself. Also the OS info. might be needed.
>
> Regards,
>
> Chris
>
>
>
> On Thursday, September 9, 2010 at 1:24:02 AM, Brett Wooldridge wrote:
> > We are using Jetty 6.1.22, which supposedly contains a fix for
> > CVE-2009-3555. However, one of our customer's security scanners
> is flagging
> > our server has having this vulnerability.
>
> > After doing some research, I found this site regarding how to
> verify that
> > SSL Renegotiation is disabled.
>
> > http://blog.ivanristic.com/2009/12/testing-for-ssl-renegotiation.html
>
> > Basically, you use openssl to connect, send a 'HEAD' request,
> initiate
> > renegotiation, and you *should* receive an error, as show below:
>
> > $ openssl s_client -connect server:443
>
> > [snip... a lot of openssl output]
>
> > ---
>
> > HEAD / HTTP/1.0<press enter>
> > R<press enter>
> > RENEGOTIATING
> > <press enter>
> > 28874:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake
> > failure:s3_pkt.c:530:
>
> > However, Jetty does NOT generate a renegotiation failure. In fact it
> > continues with renegotiation and returns the content of the head
> request.
>
> > Jetty 6.1.22's SslSelectChannelConnector is supposed to default to no
> > renegotiation (allowRenegotiate=false), but even when I set it
> explicitly in
> > the .xml configuration to false, it still seems to honor the
> renegotiation.
>
> > Can anyone shed light on this, this is a serious problem if
> CVE-2009-3555 is
> > not really fixed.
>
> > -Brett
>
>
> ---------------------------------------------------------------------
> To unsubscribe from this list, please visit:
>
> http://xircles.codehaus.org/manage_email
>
>
>
--
Jan Bartel, Webtide LLC | [email protected] | http://www.webtide.com
---------------------------------------------------------------------
To unsubscribe from this list, please visit:
http://xircles.codehaus.org/manage_email