Nom du paquet
openssl
Date
2009-09-21
Advisory ID
MDVSA-2009:238
Affected versions
2009.0 x86_64 , MES5 i586 , 2009.0 i586 , 2008.1 x86_64 , 2008.1 i586 , MES5 x86_64

Problem description

Multiple vulnerabilities was discovered and corrected in openssl:

Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment
function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote
attackers to cause a denial of service (openssl s_client crash)
and possibly have unspecified other impact via a DTLS packet, as
demonstrated by a packet from a server that uses a crafted server
certificate (CVE-2009-1379).

ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to
cause a denial of service (NULL pointer dereference and daemon crash)
via a DTLS ChangeCipherSpec packet that occurs before ClientHello
(CVE-2009-1386).

The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c
in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a
denial of service (NULL pointer dereference and daemon crash) via
an out-of-sequence DTLS handshake message, related to a fragment
bug. (CVE-2009-1387)

The NSS library library before 3.12.3, as used in Firefox; GnuTLS
before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other
products support MD2 with X.509 certificates, which might allow
remote attackers to spooof certificates by using MD2 design flaws
to generate a hash collision in less than brute-force time. NOTE:
the scope of this issue is currently limited because the amount of
computation required is still large (CVE-2009-2409).

This update provides a solution to these vulnerabilities.

Updated packages

2009.0 x86_64

 287b7f8b3d478451e16b3e391e348c5e  2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.4mdv2009.0.x86_64.rpm
 a7079cfda34bf4f4db722753244ee41b  2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.4mdv2009.0.x86_64.rpm
 047265cc0d6ac4627f9d82c3b809f362  2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.4mdv2009.0.x86_64.rpm
 9395a6acd0c2546f76da5a318d2f494f  2009.0/x86_64/openssl-0.9.8h-3.4mdv2009.0.x86_64.rpm 
 2942f8a0a8070f3a59d9bfc6c8fa50c5  2009.0/SRPMS/openssl-0.9.8h-3.4mdv2009.0.src.rpm

MES5 i586

 f7162720ce8713b9087cf91f7c2107c1  mes5/i586/libopenssl0.9.8-0.9.8h-3.4mdvmes5.i586.rpm
 fb5183cd2e7adf3013f8224363cc5391  mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.4mdvmes5.i586.rpm
 e3b7029bd10babd86023f2b3299ec957  mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.4mdvmes5.i586.rpm
 4dc42b91974a65a75412896c0517a1ac  mes5/i586/openssl-0.9.8h-3.4mdvmes5.i586.rpm 
 ba1f57df4b57fe6ba79dd083a99c1b8d  mes5/SRPMS/openssl-0.9.8h-3.4mdvmes5.src.rpm

2009.0 i586

 62125f9fde11ecec42ae21075a34f4c7  2009.0/i586/libopenssl0.9.8-0.9.8h-3.4mdv2009.0.i586.rpm
 4e21025e35ffefe8ab4b8a2d5368a450  2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.4mdv2009.0.i586.rpm
 5887cbeeb89f1e9824868d977ae7c83e  2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.4mdv2009.0.i586.rpm
 45cf6fd02fadbca35ccfc1dea1e1054e  2009.0/i586/openssl-0.9.8h-3.4mdv2009.0.i586.rpm 
 2942f8a0a8070f3a59d9bfc6c8fa50c5  2009.0/SRPMS/openssl-0.9.8h-3.4mdv2009.0.src.rpm

2008.1 x86_64

 f12af113949996063624f4c638d5c75c  2008.1/x86_64/lib64openssl0.9.8-0.9.8g-4.5mdv2008.1.x86_64.rpm
 0a6db81684a049b45d4536d583864415  2008.1/x86_64/lib64openssl0.9.8-devel-0.9.8g-4.5mdv2008.1.x86_64.rpm
 f4f9dd377c41a83af03efe923a0e106e  2008.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8g-4.5mdv2008.1.x86_64.rpm
 e317fbadd87171b291584a9275f6b656  2008.1/x86_64/openssl-0.9.8g-4.5mdv2008.1.x86_64.rpm 
 e0a15b72d2ef1d458f259368042f6321  2008.1/SRPMS/openssl-0.9.8g-4.5mdv2008.1.src.rpm

2008.1 i586

 4413a38da4754d54fc161e3c06b81c72  2008.1/i586/libopenssl0.9.8-0.9.8g-4.5mdv2008.1.i586.rpm
 7994189a9bdff555fa34d763a9eec321  2008.1/i586/libopenssl0.9.8-devel-0.9.8g-4.5mdv2008.1.i586.rpm
 bfd128daaf2831e0af5cfd5163067be9  2008.1/i586/libopenssl0.9.8-static-devel-0.9.8g-4.5mdv2008.1.i586.rpm
 cb8236b62c2edba4033f1cafa39c4ce5  2008.1/i586/openssl-0.9.8g-4.5mdv2008.1.i586.rpm 
 e0a15b72d2ef1d458f259368042f6321  2008.1/SRPMS/openssl-0.9.8g-4.5mdv2008.1.src.rpm

MES5 x86_64

 d17052790ec6dbc7c98acbc552ed1d5a  mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.4mdvmes5.x86_64.rpm
 cdba1f5866e5cb02efd5abb0671075c2  mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.4mdvmes5.x86_64.rpm
 125739bc83e5a75c554e185d40932383  mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.4mdvmes5.x86_64.rpm
 6a8ce7e9226cba94a43a561e9dff854f  mes5/x86_64/openssl-0.9.8h-3.4mdvmes5.x86_64.rpm 
 ba1f57df4b57fe6ba79dd083a99c1b8d  mes5/SRPMS/openssl-0.9.8h-3.4mdvmes5.src.rpm

References