CVE-2009-0127

M2Crypto doesn't properly check OpenSSL functions, allowing certificate chain bypass via malformed signature

• CVSS 5.0
• CWE-287 Improper Authentication
• Cryptographic
• Remote

** DISPUTED ** M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto."

CVE

CVE-2009-0127

CWE

CWE-287 Improper Authentication

CVSS base score

5.0

Published

2009-01-15

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Cryptographic Implementation Error

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update M2Crypto to a version that properly checks return values from OpenSSL functions.

from M2Crypto import SSL

def verify_signature(verify_context, signature, data):
    verify_context.verify(signature, data)

def main():
    ctx = SSL.Context('TLSv1')
    ctx.load_verify_locations('path/to/ca.pem')

    verify_context = SSL.VerificationContext(ctx)

    signature = b'some_signature'
    data = b'some_data_to_verify'

    verify_signature(verify_context, signature, data)

if __name__ == "__main__":
    main()

from M2Crypto import SSL

def verify_signature(verify_context, signature, data):
    try:
        verify_context.verify(signature, data)
    except SSL.SSLError as e:
        print(f"Signature verification failed: {e}")
        return False
    return True

def main():
    ctx = SSL.Context('tlsv1_2')
    ctx.set_verify(SSL.verify_peer, 1)
    ctx.load_verify_locations('path/to/ca.pem')

    verify_context = SSL.VerificationContext(ctx)

    signature = b'some_signature'
    data = b'some_data_to_verify'

    if verify_signature(verify_context, signature, data):
        print("Signature verification succeeded.")
    else:
        print("Signature verification failed.")

if __name__ == "__main__":
    main()

@misc{vaitp:cve20090127,
  title        = {{M2Crypto doesn't properly check OpenSSL functions, allowing certificate chain bypass via malformed signature}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2009},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2009-0127},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2009-0127/}}
}