MDVSA-2010:248

Nom du paquet
openssl
Date
2010-12-07
Advisory ID
MDVSA-2010:248
Affected versions
2009.0 x86_64 , MES5 i586 , 2010.0 x86_64 , 2010.1 i586 , 2010.0 i586 , 2009.0 i586 , CS4.0 i586 , CS4.0 x86_64 , MES5 x86_64 , 2010.1 x86_64

Problem description

A vulnerability was discovered and corrected in openssl:

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when
SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly
prevent modification of the ciphersuite in the session cache, which
allows remote attackers to force the use of an unintended cipher
via vectors involving sniffing network traffic to discover a session
identifier (CVE-2010-4180).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct this issue.

Updated packages

2009.0 x86_64

 a77409f3bedc0446f8eda39281dbf7a4  2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.9mdv2009.0.x86_64.rpm
 feffaacd70224326c3582eb93156864b  2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.9mdv2009.0.x86_64.rpm
 e2cb3f77f36b8b0a6ca214861bf79be3  2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.9mdv2009.0.x86_64.rpm
 d6e667e012727d34442e23f91b005b40  2009.0/x86_64/openssl-0.9.8h-3.9mdv2009.0.x86_64.rpm 
 6e96fc588f1921571046fbc14928e5a1  2009.0/SRPMS/openssl-0.9.8h-3.9mdv2009.0.src.rpm

MES5 i586

 09c73809185dfb05bd8545e46bb8b215  mes5/i586/libopenssl0.9.8-0.9.8h-3.9mdvmes5.1.i586.rpm
 cefb1c9e7fbc54ef678c3cbb16fb4983  mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.9mdvmes5.1.i586.rpm
 1f1810faa0ec3f1cf298882752826903  mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.9mdvmes5.1.i586.rpm
 48ce5b2ac3e114dd33d8274d01baf357  mes5/i586/openssl-0.9.8h-3.9mdvmes5.1.i586.rpm 
 487d48389d5b8bd2486e29f052749651  mes5/SRPMS/openssl-0.9.8h-3.9mdvmes5.1.src.rpm

2010.0 x86_64

 391cb84677230e2c39708db0797b2e87  2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.4mdv2010.0.x86_64.rpm
 7f251668cfd04bd1e2a634030c28929f  2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.4mdv2010.0.x86_64.rpm
 9110c45d54ce48c4ad0c8fe231f7f027  2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.4mdv2010.0.x86_64.rpm
 43e7eae967aad5b140eed29dab277aa2  2010.0/x86_64/openssl-0.9.8k-5.4mdv2010.0.x86_64.rpm 
 27fc76be287e1cd06adb2725df0c4167  2010.0/SRPMS/openssl-0.9.8k-5.4mdv2010.0.src.rpm

2010.1 i586

 9cf211d5095ca7a5a82aa980d4eebd5d  2010.1/i586/libopenssl1.0.0-1.0.0a-1.6mdv2010.1.i586.rpm
 788019361b199d0b6a0f3331294ac154  2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.6mdv2010.1.i586.rpm
 b2372b8919a8ab458ade4ce47080f7ff  2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.6mdv2010.1.i586.rpm
 cd5929de815b6eec25d1d683f4363db0  2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.6mdv2010.1.i586.rpm
 60fee57d944361e4fa369412c71a59a9  2010.1/i586/openssl-1.0.0a-1.6mdv2010.1.i586.rpm 
 2f28a567af2f44df1fbac7006d27db5d  2010.1/SRPMS/openssl-1.0.0a-1.6mdv2010.1.src.rpm

2010.0 i586

 86223cb60de3ea76f185425da6b299f2  2010.0/i586/libopenssl0.9.8-0.9.8k-5.4mdv2010.0.i586.rpm
 7624aa325a944ee5f4898dfd3a1c4340  2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.4mdv2010.0.i586.rpm
 95ac866a31973ccf4c2e6d04012e7e67  2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.4mdv2010.0.i586.rpm
 445c417e7de8145daefedf113b343ff5  2010.0/i586/openssl-0.9.8k-5.4mdv2010.0.i586.rpm 
 27fc76be287e1cd06adb2725df0c4167  2010.0/SRPMS/openssl-0.9.8k-5.4mdv2010.0.src.rpm

2009.0 i586

 a4b19ac2810b464392bb2f3b5292fe67  2009.0/i586/libopenssl0.9.8-0.9.8h-3.9mdv2009.0.i586.rpm
 6169959e4a5f0acbdab7269ac99baa8d  2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.9mdv2009.0.i586.rpm
 64195ec5f2e7868a49c280d3a32168cd  2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.9mdv2009.0.i586.rpm
 7a1c151567d7f9d364a79ecd63322d47  2009.0/i586/openssl-0.9.8h-3.9mdv2009.0.i586.rpm 
 6e96fc588f1921571046fbc14928e5a1  2009.0/SRPMS/openssl-0.9.8h-3.9mdv2009.0.src.rpm

CS4.0 i586

 3f7610ee9ee7aa4b8d1ed3997e28d09b  corporate/4.0/i586/libopenssl0.9.7-0.9.7g-2.13.20060mlcs4.i586.rpm
 25a4686ef5ca8302eebf2f1b4fe67e35  corporate/4.0/i586/libopenssl0.9.7-devel-0.9.7g-2.13.20060mlcs4.i586.rpm
 c5f5a562293eae123b05a96d3ba663d7  corporate/4.0/i586/libopenssl0.9.7-static-devel-0.9.7g-2.13.20060mlcs4.i586.rpm
 e50aac28cc844b0184f3203bb34fa682  corporate/4.0/i586/openssl-0.9.7g-2.13.20060mlcs4.i586.rpm 
 646cced4e21e4bf657254040ddbc1a47  corporate/4.0/SRPMS/openssl-0.9.7g-2.13.20060mlcs4.src.rpm

CS4.0 x86_64

 f68f167e440886222c949078044281eb  corporate/4.0/x86_64/lib64openssl0.9.7-0.9.7g-2.13.20060mlcs4.x86_64.rpm
 ab7cc2cc749717199afb25c094035945  corporate/4.0/x86_64/lib64openssl0.9.7-devel-0.9.7g-2.13.20060mlcs4.x86_64.rpm
 f7f9a378a4e77af084330d2206c86e5e  corporate/4.0/x86_64/lib64openssl0.9.7-static-devel-0.9.7g-2.13.20060mlcs4.x86_64.rpm
 fdcc7edc730c1ec56424328cefcbdfae  corporate/4.0/x86_64/openssl-0.9.7g-2.13.20060mlcs4.x86_64.rpm 
 646cced4e21e4bf657254040ddbc1a47  corporate/4.0/SRPMS/openssl-0.9.7g-2.13.20060mlcs4.src.rpm

MES5 x86_64

 4ad42bf2e7beae5a935649df07c000e6  mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.9mdvmes5.1.x86_64.rpm
 709be621d6080125c051d9793cb92b26  mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.9mdvmes5.1.x86_64.rpm
 000098b8f9b1778bcb3ff01b504e697b  mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.9mdvmes5.1.x86_64.rpm
 ab35ec2ae8b1482722baee700b16f121  mes5/x86_64/openssl-0.9.8h-3.9mdvmes5.1.x86_64.rpm 
 487d48389d5b8bd2486e29f052749651  mes5/SRPMS/openssl-0.9.8h-3.9mdvmes5.1.src.rpm

2010.1 x86_64

 ab021cadcaa131053ba5ac3940298f86  2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.6mdv2010.1.x86_64.rpm
 a2119fefbe8cfb649e88b3faf85ffba1  2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.6mdv2010.1.x86_64.rpm
 067878d8ff9ec0002c0a7653a1b87b05  2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.6mdv2010.1.x86_64.rpm
 60a8142259ee202b6327e8a2c0f86755  2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.6mdv2010.1.x86_64.rpm
 a4c77c129fd43f7918075fadf461fe8b  2010.1/x86_64/openssl-1.0.0a-1.6mdv2010.1.x86_64.rpm 
 2f28a567af2f44df1fbac7006d27db5d  2010.1/SRPMS/openssl-1.0.0a-1.6mdv2010.1.src.rpm

References