This update fixes several security issues in openssl :

  - The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL     0.9.8f through 0.9.8m allows remote attackers to cause a     denial of service (crash) via a malformed record in a     TLS connection (CVE-2010-0740)

  - OpenSSL before 0.9.8m does not check for a NULL return     value from bn_wexpand function calls which has     unspecified impact and context-dependent attack vectors     (CVE-2009-3245)

  - The kssl_keytab_is_available function in ssl/kssl.c in     OpenSSL before 0.9.8n, when Kerberos is enabled but     Kerberos configuration files cannot be opened, could     allow remote attackers to cause a denial of service     (NULL pointer dereference and daemon crash)     (CVE-2010-0433)

  - Finally, this update provides support for secure     renegotiation, preventing men-in-the-middle attacks     (CVE-2009-3555).

Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products.

Update :

Packages for 2009.0 are provided due to the Extended Maintenance Program.

Updated openssl096b packages that fix one security issue are now available for Red Hat Enterprise Linux 3 and 4.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.

It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could cause an application using the OpenSSL library to crash or, possibly, execute arbitrary code.
(CVE-2009-3245)

All openssl096b users should upgrade to these updated packages, which contain a backported patch to resolve this issue. For the update to take effect, all programs using the openssl096b library must be restarted.

This update adds support for RFC5746 TLS renegotiations to address vulnerabilities tracked as (CVE-2009-3555). It also fixes a mishandling of OOM conditions in bn_wexpand. (CVE-2009-3245)

Installation notes

This update is provided as RPM packages that can easily be installed onto a running system by using this command :

rpm -Fvh libopenssl-devel.rpm libopenssl0_9_8.rpm libopenssl0_9_8-32bit.rpm libopenssl0_9_8-x86.rpm openssl.rpm openssl-debuginfo.rpm openssl-debugsource.rpm openssl-doc.rpm

New openssl packages are available for Slackware 11.0, 12.0, 12.1, 12.2, 13.0, and -current to fix security issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability

  - replace expired GlobalSign Root CA certificate in     ca-bundle.crt

  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack     (#907589)

  - fix for CVE-2013-0166 - DoS in OCSP signatures checking     (#908052)

  - enable compression only if explicitly asked for or     OPENSSL_DEFAULT_ZLIB environment variable is set (fixes     CVE-2012-4929 #857051)

  - use __secure_getenv everywhere instead of getenv     (#839735)

  - fix for CVE-2012-2333 - improper checking for record     length in DTLS (#820686)

  - fix for CVE-2012-2110 - memory corruption in     asn1_d2i_read_bio (#814185)

  - fix problem with the SGC restart patch that might     terminate handshake incorrectly

  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7     code (#802725)

  - fix for CVE-2012-1165 - NULL read dereference on bad     MIME headers (#802489)

  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext     recovery vulnerability and additional DTLS fixes     (#771770)

  - fix for CVE-2011-4109 - double free in policy checks     (#771771)

  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding     (#771775)

  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)

  - add known answer test for SHA2 algorithms (#740866)

  - make default private key length in certificate Makefile     2048 bits (can be changed with PRIVATE_KEY_BITS setting)     (#745410)

  - fix incorrect return value in parse_yesno (#726593)

  - added DigiCert CA certificates to ca-bundle (#735819)

  - added a new section about error states to README.FIPS     (#628976)

  - add missing DH_check_pub_key call when DH key is     computed (#698175)

  - presort list of ciphers available in SSL (#688901)

  - accept connection in s_server even if getaddrinfo fails     (#561260)

  - point to openssl dgst for list of supported digests     (#608639)

  - fix handling of future TLS versions (#599112)

  - added VeriSign Class 3 Public Primary Certification     Authority - G5 and StartCom Certification Authority     certs to ca-bundle (#675671, #617856)

  - upstream fixes for the CHIL engine (#622003, #671484)

  - add SHA-2 hashes in SSL_library_init (#676384)

  - fix CVE-2010-4180 - completely disable code for     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)

  - fix CVE-2009-3245 - add missing bn_wexpand return checks     (#570924)

  - fix CVE-2010-0433 - do not pass NULL princ to     krb5_kt_get_entry which in the RHEL-5 and newer versions     will crash in such case (#569774)

  - fix CVE-2009-3555 - support the safe renegotiation     extension and do not allow legacy renegotiation on the     server by default (#533125)

  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables     (#510197)

  - fix CVE-2009-4355 - do not leak memory when     CRYPTO_cleanup_all_ex_data is called prematurely by     application (#546707)

A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270)

Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled.

It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could possibly crash an application using the OpenSSL library and its UBSEC hardware engine support. (CVE-2009-3245 - SL4 Only)

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

ID	名稱	產品	系列	已發布	已更新	嚴重性
45563	Mandriva Linux Security Advisory : openssl (MDVSA-2010:076-1)	Nessus	Mandriva Local Security Checks	2010/4/19	2021/1/6	critical
46280	RHEL 3 / 4 : openssl096b (RHSA-2010:0173)	Nessus	Red Hat Local Security Checks	2010/5/11	2021/1/14	critical
50937	SuSE 11 Security Update : OpenSSL (SAT Patch Number 2214)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	critical
44946	Slackware 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / current : openssl (SSA:2010-060-02)	Nessus	Slackware Local Security Checks	2010/3/2	2021/1/14	critical
79531	OracleVM 2.2 : openssl (OVMSA-2014-0007)	Nessus	OracleVM Local Security Checks	2014/11/26	2022/12/5	high
60921	Scientific Linux Security Update : openssl on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

high

critical