MDVSA-2009:238
- Nom du paquet
- openssl
- Date
- 2009-09-21
- Advisory ID
- MDVSA-2009:238
- Affected versions
- 2009.0 x86_64 , MES5 i586 , 2009.0 i586 , 2008.1 x86_64 , 2008.1 i586 , MES5 x86_64
Problem description
Multiple vulnerabilities was discovered and corrected in openssl:
Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment
function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote
attackers to cause a denial of service (openssl s_client crash)
and possibly have unspecified other impact via a DTLS packet, as
demonstrated by a packet from a server that uses a crafted server
certificate (CVE-2009-1379).
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to
cause a denial of service (NULL pointer dereference and daemon crash)
via a DTLS ChangeCipherSpec packet that occurs before ClientHello
(CVE-2009-1386).
The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c
in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a
denial of service (NULL pointer dereference and daemon crash) via
an out-of-sequence DTLS handshake message, related to a fragment
bug. (CVE-2009-1387)
The NSS library library before 3.12.3, as used in Firefox; GnuTLS
before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other
products support MD2 with X.509 certificates, which might allow
remote attackers to spooof certificates by using MD2 design flaws
to generate a hash collision in less than brute-force time. NOTE:
the scope of this issue is currently limited because the amount of
computation required is still large (CVE-2009-2409).
This update provides a solution to these vulnerabilities.
Updated packages
2009.0 x86_64
287b7f8b3d478451e16b3e391e348c5e 2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.4mdv2009.0.x86_64.rpm a7079cfda34bf4f4db722753244ee41b 2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.4mdv2009.0.x86_64.rpm 047265cc0d6ac4627f9d82c3b809f362 2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.4mdv2009.0.x86_64.rpm 9395a6acd0c2546f76da5a318d2f494f 2009.0/x86_64/openssl-0.9.8h-3.4mdv2009.0.x86_64.rpm 2942f8a0a8070f3a59d9bfc6c8fa50c5 2009.0/SRPMS/openssl-0.9.8h-3.4mdv2009.0.src.rpm
MES5 i586
f7162720ce8713b9087cf91f7c2107c1 mes5/i586/libopenssl0.9.8-0.9.8h-3.4mdvmes5.i586.rpm fb5183cd2e7adf3013f8224363cc5391 mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.4mdvmes5.i586.rpm e3b7029bd10babd86023f2b3299ec957 mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.4mdvmes5.i586.rpm 4dc42b91974a65a75412896c0517a1ac mes5/i586/openssl-0.9.8h-3.4mdvmes5.i586.rpm ba1f57df4b57fe6ba79dd083a99c1b8d mes5/SRPMS/openssl-0.9.8h-3.4mdvmes5.src.rpm
2009.0 i586
62125f9fde11ecec42ae21075a34f4c7 2009.0/i586/libopenssl0.9.8-0.9.8h-3.4mdv2009.0.i586.rpm 4e21025e35ffefe8ab4b8a2d5368a450 2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.4mdv2009.0.i586.rpm 5887cbeeb89f1e9824868d977ae7c83e 2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.4mdv2009.0.i586.rpm 45cf6fd02fadbca35ccfc1dea1e1054e 2009.0/i586/openssl-0.9.8h-3.4mdv2009.0.i586.rpm 2942f8a0a8070f3a59d9bfc6c8fa50c5 2009.0/SRPMS/openssl-0.9.8h-3.4mdv2009.0.src.rpm
2008.1 x86_64
f12af113949996063624f4c638d5c75c 2008.1/x86_64/lib64openssl0.9.8-0.9.8g-4.5mdv2008.1.x86_64.rpm 0a6db81684a049b45d4536d583864415 2008.1/x86_64/lib64openssl0.9.8-devel-0.9.8g-4.5mdv2008.1.x86_64.rpm f4f9dd377c41a83af03efe923a0e106e 2008.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8g-4.5mdv2008.1.x86_64.rpm e317fbadd87171b291584a9275f6b656 2008.1/x86_64/openssl-0.9.8g-4.5mdv2008.1.x86_64.rpm e0a15b72d2ef1d458f259368042f6321 2008.1/SRPMS/openssl-0.9.8g-4.5mdv2008.1.src.rpm
2008.1 i586
4413a38da4754d54fc161e3c06b81c72 2008.1/i586/libopenssl0.9.8-0.9.8g-4.5mdv2008.1.i586.rpm 7994189a9bdff555fa34d763a9eec321 2008.1/i586/libopenssl0.9.8-devel-0.9.8g-4.5mdv2008.1.i586.rpm bfd128daaf2831e0af5cfd5163067be9 2008.1/i586/libopenssl0.9.8-static-devel-0.9.8g-4.5mdv2008.1.i586.rpm cb8236b62c2edba4033f1cafa39c4ce5 2008.1/i586/openssl-0.9.8g-4.5mdv2008.1.i586.rpm e0a15b72d2ef1d458f259368042f6321 2008.1/SRPMS/openssl-0.9.8g-4.5mdv2008.1.src.rpm
MES5 x86_64
d17052790ec6dbc7c98acbc552ed1d5a mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.4mdvmes5.x86_64.rpm cdba1f5866e5cb02efd5abb0671075c2 mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.4mdvmes5.x86_64.rpm 125739bc83e5a75c554e185d40932383 mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.4mdvmes5.x86_64.rpm 6a8ce7e9226cba94a43a561e9dff854f mes5/x86_64/openssl-0.9.8h-3.4mdvmes5.x86_64.rpm ba1f57df4b57fe6ba79dd083a99c1b8d mes5/SRPMS/openssl-0.9.8h-3.4mdvmes5.src.rpm