[ MDVSA-2008:107 ] - Updated openssl package fixes denial of service vulnerabilities




-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:107
http://www.mandriva.com/security/
_______________________________________________________________________

Package : openssl
Date : May 28, 2008
Affected: 2008.1
_______________________________________________________________________

Problem Description:

Testing using the Codenomicon TLS test suite discovered a flaw in
the handling of server name extension data in OpenSSL 0.9.8f and
OpenSSL 0.9.8g. If OpenSSL has been compiled using the non-default
TLS server name extensions, a remote attacker could send a carefully
crafted packet to a server application using OpenSSL and cause a
crash. (CVE-2008-0891)

Testing using the Codenomicon TLS test suite discovered a flaw if
the 'Server Key exchange message' is omitted from a TLS handshake
in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If a client connects to a
malicious server with particular cipher suites, the server could
cause the client to crash. (CVE-2008-1672)

The updated packages have been patched to fix these flaws.

Note that any applications using this library must be restarted for
the update to take effect.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0891
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1672
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2008.1:
c89ce51d88565b5e01984d02f9d52be2 2008.1/i586/libopenssl0.9.8-0.9.8g-4.1mdv2008.1.i586.rpm
1e1855ac131d2f1d7fe185a972d6cf7e 2008.1/i586/libopenssl0.9.8-devel-0.9.8g-4.1mdv2008.1.i586.rpm
abda43307f35316915bf8fab630b5aa4 2008.1/i586/libopenssl0.9.8-static-devel-0.9.8g-4.1mdv2008.1.i586.rpm
ad370f030884f7e81eee21ad8ea14b9f 2008.1/i586/openssl-0.9.8g-4.1mdv2008.1.i586.rpm
0081f3e2bd9e38ffa4c27e87e8d2c8ba 2008.1/SRPMS/openssl-0.9.8g-4.1mdv2008.0.src.rpm

Mandriva Linux 2008.1/X86_64:
e647498bde13d7baebff21a595a7235f 2008.1/x86_64/lib64openssl0.9.8-0.9.8g-4.1mdv2008.1.x86_64.rpm
1afca1fc4741b583413ba74b42617414 2008.1/x86_64/lib64openssl0.9.8-devel-0.9.8g-4.1mdv2008.1.x86_64.rpm
2a9eb1a4d9785234ab7ea71f74835009 2008.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8g-4.1mdv2008.1.x86_64.rpm
d9d185ea96fcfa64b11b5318fbdff0e2 2008.1/x86_64/openssl-0.9.8g-4.1mdv2008.1.x86_64.rpm
0081f3e2bd9e38ffa4c27e87e8d2c8ba 2008.1/SRPMS/openssl-0.9.8g-4.1mdv2008.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFIPXOFmqjQ0CJFipgRAvQRAJ0aMdxKc+WzCaar5aXcNPif+VMBAwCggx93
MUhEXWV3Mg6NEX0jj/qg7gg=
=1WTI
-----END PGP SIGNATURE-----



Relevant Pages

  • [ MDVSA-2014:106 ] openssl
    ... Multiple vulnerabilities has been discovered and corrected in openssl: ... Updated Packages: ... All packages are signed by Mandriva for security. ...
    (Bugtraq)
  • [Full-disclosure] [ MDVSA-2008:107 ] - Updated openssl package fixes denial of service v
    ... Package: openssl ... Testing using the Codenomicon TLS test suite discovered a flaw in ... The updated packages have been patched to fix these flaws. ... Mandriva Linux 2008.1/X86_64: ...
    (Full-Disclosure)
  • [Full-disclosure] [ MDVSA-2012:006 ] openssl
    ... Affected: 2010.1, Enterprise Server 5.0 ... Multiple vulnerabilities has been found and corrected in openssl: ... The updated packages have been patched to correct these issues. ... Mandriva Linux 2010.1/X86_64: ...
    (Full-Disclosure)
  • [ MDVSA-2012:006 ] openssl
    ... Affected: 2010.1, Enterprise Server 5.0 ... Multiple vulnerabilities has been found and corrected in openssl: ... The updated packages have been patched to correct these issues. ... Mandriva Linux 2010.1/X86_64: ...
    (Bugtraq)
  • [Full-disclosure] [ MDVSA-2009:310 ] openssl
    ... Package: openssl ... DTLS records that are buffered in a queue, ... The updated packages have been patched to prevent this. ... Mandriva Linux 2008.0/X86_64: ...
    (Full-Disclosure)