UnrealIRCd and the recent OpenSSL advisory (CVE-2021-3449)

[Bram M. <sy...@un...>]

Hi everyone,

Today, the OpenSSL project issued a security advisory 
<https://www.openssl.org/news/secadv/20210325.txt>: "NULL pointer deref 
in signature_algorithms processing (CVE-2021-3449)".
This bug is not UnrealIRCd-specific. It basically means most SSL/TLS 
servers on the Internet can be crashed. Other than crashing the server 
no damage can be done (no execution of code). The bug description is 
very clear so personally I expect exploits to be published soon, today 
or tomorrow, that will allow malicious people to crash SSL/TLS servers 
(apache, nginx, etc).
This also means an attacker can crash UnrealIRCd. And, as we all know, 
crashing an IRC server can be quite troublesome, since it means everyone 
disconnects and a lot of text/havoc on the screen.

We highly recommend to upgrade the OpenSSL package on your 
system/distro. Consult your system/distro security announcements and 
documentation for how to do so.

After upgrading OpenSSL you would have to restart UnrealIRCd to fix the 
crash bug. It cannot be fixed with a /REHASH. Only a restart will cause 
it to load the (upgraded) OpenSSL library.
Or, alternatively, don't do the restart and risk an attacker crashing it 
once, and then let a cron job bring it back up a few minutes later with 
the fixed openssl. Of course, an evil guy may crash all your servers at 
once at some inconvenient time, so whether that is a good idea or not is 
up to you. The choice is yours.

There is technically no need to recompile UnrealIRCd. But, if you are 
restarting UnrealIRCd anyway, then maybe you could consider upgrading 
UnrealIRCd at the same time to latest version (5.0.9 as we speak), to 
kill two birds with one stone. But, again, this is not required!

UnrealIRCd itself does not ship with any openssl code so there will be 
no fixed /source code/ release.
The only /binary releases/ we have that uses an SSL library is the 
Windows one. Currently it is unknown if it is affected by the bug as it 
uses libressl instead of openssl. We will do a new windows release if 
libressl does a security announcement somewhere in the next few days.

Please do not contact us for help with configuring or upgrading your 
OpenSSL. This is not our code, we are simply using this library just 
like most SSL/TLS programs out there.

Regards,

Bram Matthys (Syzop)

-- 

Bram Matthys
Security and software eng...@vu...
Website:www.vulnscan.org
PGP key:www.vulnscan.org/pubkey.asc
PGP fp: EBCA 8977 FCA6 0AB0 6EDB  04A7 6E67 6D45 7FE1 99A6