Heap overflow bug in OpenSSL

Re:Heap overflow bug in OpenSSL by tptacek on Thursday April 19, 2012 @10:25AM (#3863124)

Actually, all of the SNMP implementations were savaged by ASN.1/BER implementation bugs: the format is so poorly understood that virtually all of them derived from the same code.

There is a trick to ASN.1/DER encoding that gets it down into the hundreds- of- lines- of- code range (you get the whole document in memory and serialize/unserialize it backwards). I once wrote a program that converted arbitrary ASN.1/DER/BER buffers into a shell script that regenerated the same. It's not as complicated as it looks, but it's idiosyncratic and you have to think about it a specific way.

That said: I agree, it should be scorched off the planet with fire.

[ Parent | on HN ]

Re:Heap overflow bug in OpenSSL by samroberts on Monday April 23, 2012 @11:52AM (#3879378)

How do you go backwards? You don't know the length of the last element/position of the last tag unless you work forward from the front, as far as I can see.

BER is complicated, but no more complicated than rfc-822 style headers, which are also poorly parsed by ad-hoc parsers, and were a wide source of vulnerabilities.

[ Parent | on HN ]