OpenSSL_DTLS_CVE_2014_0221

OpenSSL DTLS CVE-2014-0221 Remote Denial

What is DTLS (Datagram Transport Layer Security)?

Datagram Transport Layer Security. *Physical layer

TCP layer datagram support: TLS
UDP layer datagram support: DTLS: Through appropriate modifications of the Handshake process, it handles key exchange, authentication, security parameter settings, etc., and supports reliable secure communication over UDP, which has connectionless characteristics, via timeout and retransmission

DTLS stands for Datagram Transport Layer Security, a protocol designed to provide security in UDP-based communication. TLS (Transport Layer Security) is primarily used to provide security in TCP-based communication, but since UDP is a connectionless, packet-based protocol, it is difficult to apply TLS directly. DTLS was designed to provide security in such UDP-based communication.

DTLS is very similar to the basic structure of TLS, but has several key differences:

Datagram support: DTLS is designed to be suitable for UDP, a datagram-based protocol. TLS is optimized for connection-oriented TCP, so it has been adapted to operate on a datagram basis for UDP.
Appropriate modifications of the Handshake process: Like TLS, DTLS uses the Handshake process to handle authentication, key exchange, and security parameter settings of communication. However, due to the characteristics of UDP, packet loss or order changes may occur, so mechanisms to handle these situations have been added to DTLS.
Timeout and retransmission: DTLS includes timeout and retransmission mechanisms to handle packet loss or retransmission needs. This compensates for UDP's connectionless nature, enabling reliable secure communication.
Security considerations: DTLS uses the same security protocols as TLS to ensure data confidentiality, integrity, and authentication. Therefore, data can be transmitted securely in UDP-based applications.
DTLS is primarily used to provide security in environments using UDP such as VoIP (voice calls), multimedia streaming, and game servers.

Then, OpenSSL DTLS Vulnerabilities

Why OpenSSL?: What is DTLS: UDP-based TLS, DTLS 1.0 was implemented in OpenSSL

Vulnerability that allows a man-in-the-middle (MITM) attack via a crafted handshake transmission to decrypt transmitted data and manipulate transmitted data between server/client (CVE-2014-0224)
Vulnerability that allows a denial of service attack by sending an abnormal DTLS handshake to an OpenSSL DTLS client (CVE-2014-0221)
Vulnerability that allows arbitrary code execution by sending an abnormal DTLS fragment to an OpenSSL DTLS client or server (CVE-2014-0195)
Vulnerability that allows arbitrary code execution due to a flaw in the do_ssl3_write function (CVE-2014-0198)
This vulnerability occurs in OpenSSL 1.0.0 and 1.0.1 when the SSL_MODE_RELEASE_BUFFERS option is enabled (this option is disabled by default)
Vulnerability that allows an attacker to inject data into a session or cause a denial of service due to a race condition in the ssl3_read_bytes function (CVE-2010-5298)
This vulnerability occurs in multithreaded applications using OpenSSL 1.0.0 and 1.0.1 when the SSL_MODE_RELEASE_BUFFERS option is enabled (this option is disabled by default)
Vulnerability that can cause a denial of service attack on an OpenSSL TLS client with anonymous ECDH ciphersuites enabled (CVE-2014-3470)

Affected Products and Versions

OpenSSL 0.9.8 versions
OpenSSL 1.0.0 versions
OpenSSL 1.0.1 versions
Among these, CVE-2014-0221 is a vulnerability that allows a denial of service attack by sending an abnormal DTLS handshake to an OpenSSL DTLS client

About CVE-2014-0221

< DTLS Denial of Service Vulnerability (CVE-2014-0221) >
o DTLS (Datagram Transport Layer Security) is a protocol based on TLS that transmits encrypted datagrams.
o When an abnormal DTLS handshake message (DTLS Hello message) is sent to a DTLS client, OpenSSL is implemented in a way that can fall into a recursive state, enabling a denial of service attack.

• The function recursively calls itself while processing the DTLS Hello message.

Example code: Recursive call portion of dtls1_get_message_frament method

if(!s->server && s->d1->r_msg_hdr.frag_off == 0 && wire[0] == SSL3_MT_HELLO_REQUEST) {
    if(wire[1] == 0 && wire[2] == 0 && wire[3] == 0) {
        if(s->msg_callback)
            s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE,
                wire, DTLS1_HM_HEADER_LENGTH, s, s->msg_callback_arg);

            s->init_num = 0;
            return dtls1_get_message_fragment(s, st1, stn, max, ok);
    }
    else {
        al=SSL_AD_UNEXPECTED_MESSAGE;
        SSLerr(SSL_F_DTLS1_GET_MESSAGE_FRAGMENT,SSL_R_UNEXPECTED_MESSAGE);
        goto f_err;
    }
}