There's a critical vulnerability in some versions of the widely used OpenSSL code library that in some cases allows attackers to impersonate cryptographically protected websites, e-mail servers, and virtual private networks, according to an advisory issued early Thursday morning.
The bug allows attackers to force vulnerable end-user applications into treating an invalid certificate as a legitimate transport layer security (TLS) or secure sockets layer (SSL) credential. As a result, adversaries with the ability to monitor a connection between the end user and trusted server could intercept or even modify data passing between them. The vulnerability resides in OpenSSL versions 1.0.2c, 1.0.2b, 1.0.1n, and 1.0.10. The flaw appears to have been added earlier this year, based on this Github contribution dated January 27.
The flaw has the potential to be extremely serious because in certain cases it makes it trivial to bypass the most popular—and in many cases, the only—form of encryption and cryptographic authentication available for websites, e-mail servers, and virtual private networks. The bug allows attackers to bypass certain checks that are supposed to be carried out when an end-user app is establishing an encrypted session with a server. As a result, the attacker can make an invalid certificate appear as if it belongs to a trusted certificate authority and issue forged certificates for any website.
Read 4 remaining paragraphs | Comments