Bug#803204: libiksemel: utterly insecure GNUTLS settings

From	Marc Dequènes (duck) <duck@duckcorp.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#803204: libiksemel: utterly insecure GNUTLS settings
Date	2015-10-27 23:30 +0100
Message-ID	<qokUG-2vz-3@gated-at.bofh.it> (permalink)
Organization	DuckCorp

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: libiksemel
Version: 1.4-2
Severity: grave
tags: security
Control: affects -1 = zabbix-server-pgsql zabbix-server-mysql


Coin,

Since I changed my XMPP server, Zabbix failed to send alerts via XMPP 
with "tls handshake failed". The XMPP server said "no shared cipher". 
After some research to see how Zabbix do its job I ended up into this 
library. I confirmed there is no way to setup the ciphers into Zabbix, 
but I was then astonished to see them hardcoded and very low grade in 
libiksemel:
        const int protocol_priority[] = { GNUTLS_TLS1, GNUTLS_SSL3, 0 };
        const int kx_priority[] = { GNUTLS_KX_RSA, 0 };
        const int cipher_priority[] = { GNUTLS_CIPHER_3DES_CBC, 
GNUTLS_CIPHER_ARCFOUR, 0};
        const int comp_priority[] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 
0 };
        const int mac_priority[] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };

SSL3, 3DES, RC4, SSL compression… With this setting not only low grade 
ciphers are available, but higher grades are disabled. So this is a 
major security issue, also affecting stable.

The following patch fixes the security problem (and compatibility 
problem with servers rejecting low grade ciphers). You should 
nevertheless proofread my choices, as I'm no security expert. The patch 
does not change the original priority lists because I failed somehow to 
fix them all, so I replaced it by a priority string (which is a 
non-obsolete method to do it anyway).

Regards.

-- 
Marc Dequènes

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#803204: libiksemel: utterly insecure GNUTLS settings Marc Dequènes (duck) <duck@duckcorp.org> - 2015-10-27 23:30 +0100
  Bug#803204: marked as done (libiksemel: utterly insecure GNUTLS  settings) owner@bugs.debian.org (Debian Bug Tracking System) - 2015-10-28 00:10 +0100

csiph-web