[Full-Disclosure] GLSA: openssl (200303-20)

From: Daniel Ahlberg (aliz@gentoo.org)
Date: 03/24/03

  • Next message: Daniel Ahlberg: "[Full-Disclosure] GLSA: bitchx (200303-21)" 
    From: Daniel Ahlberg <aliz@gentoo.org>
To: full-disclosure@lists.netsys.com
Date: Mon, 24 Mar 2003 12:51:19 +0100

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - ---------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200303-20
    - - ---------------------------------------------------------------------

              PACKAGE : openssl
              SUMMARY : Klima-Pokorny-Rosa attack
                 DATE : 2003-03-24 11:51 UTC
              EXPLOIT : remote
    VERSIONS AFFECTED : <0.9.6i-r2
        FIXED VERSION : >=0.9.6i-r2
                  CVE : CAN-2003-0131

    - - ---------------------------------------------------------------------

    - From advisory:

    "Czech cryptologists Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa
    have come up with an extension of the "Bleichenbacher attack" on RSA
    with PKCS #1 v1.5 padding as used in SSL 3.0 and TLS 1.0. Their
    attack requires the attacker to open millions of SSL/TLS connections
    to the server under attack; the server's behaviour when faced with
    specially made-up RSA ciphertexts can reveal information that in
    effect allows the attacker to perform a single RSA private key
    operation on a ciphertext of its choice using the server's RSA key.
    Note that the server's RSA key is not compromised in this attack."

    Read the full advisory at:
    http://www.openssl.org/news/secadv_20030319.txt

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    dev-libs/openssl upgrade to openssl-0.9.6i-r2 as follows:

    emerge sync
    emerge openssl
    emerge clean

    - - ---------------------------------------------------------------------
    aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
    - - ---------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+fvEtfT7nyhUpoZMRAjGBAJ9fkr/E5rMWv7Sp1YBg+3rRNqbS6wCglHh8
    XW2wBWHA0/W3NXOz+ONEFTg=
    =l0Nr
    -----END PGP SIGNATURE-----
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Daniel Ahlberg: "[Full-Disclosure] GLSA: bitchx (200303-21)"

    Relevant Pages