🇰🇷 한글 설명
ARRL tqsllib 2.0의 tqsl_verifyDataBlock 함수가 OpenSSL EVP_VerifyFinal 함수의 반환값을 적절히 검사하지 않아 발생하는 취약점입니다. 공격자가 변조된 SSL/TLS 서명을 통해 인증서 체인 검증을 우회할 수 있습니다.
💡 쉬운 설명
The software doesn't properly verify digital signatures when checking SSL certificates, allowing attackers to use fake signatures. This enables bad actors to impersonate legitimate websites or systems.
🇺🇸 원문 (English)
The tqsl_verifyDataBlock function in openssl_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.
📍 영향받는 시스템
ARRL tqsllib 2.0 and earlier versions
⚔️ 공격 벡터
Remote attackers send malformed SSL/TLS signatures to bypass certificate chain validation
🛡️ 대응 방법
Upgrade ARRL tqsllib to version 2.1 or later
🔧 검증 코드
If version 2.0 is found, the system is vulnerable; version 2.1+ indicates the patch is applied
(dpkg -l tqsllib 2>/dev/null || rpm -q tqsllib 2>/dev/null) | grep -oE '2\.[0-9]+'