bugtraq - [slackware-security] OpenSSL security update (SSA:2003-273-01)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.58.0309302248010.6419@bob.slackware.com>
Date: Tue, 30 Sep 2003 22:48:55 -0700 (PDT)
From: Slackware Security Team <security@...ckware.com>
To: slackware-security@...ckware.com
Subject: [slackware-security]  OpenSSL security update (SSA:2003-273-01)



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  OpenSSL security update (SSA:2003-273-01)

Upgraded OpenSSL packages are available for Slackware 8.1, 9.0,
9.1, and -current.  These fix problems with ASN.1 parsing which
could lead to a denial of service.  It is not known whether the
problems could lead to the running of malicious code on the
server, but it has not been ruled out.

We recommend sites that use OpenSSL upgrade to the fixed packages
right away.


Here are the details from the Slackware 9.1 ChangeLog:
+--------------------------+
Tue Sep 30 16:16:35 PDT 2003
patches/packages/openssl-0.9.7c-i486-1.tgz:  Upgraded to OpenSSL 0.9.7c.
patches/packages/openssl-solibs-0.9.7c-i486-1.tgz:  Upgraded to OpenSSL 0.9.7c.
  This update fixes problems with OpenSSL's ASN.1 parsing which could lead to
  a denial of service.  It is not known whether the problems could lead to the
  running of malicious code on the server, but it has not been ruled out.
  For detailed information, see OpenSSL's security advisory:
    http://www.openssl.org/news/secadv_20030930.txt
  We recommend sites that use OpenSSL upgrade to the fixed packages right away.
  (* Security fix *)
+--------------------------+


WHERE TO FIND THE NEW PACKAGES:
+-----------------------------+

Updated packages for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssl-0.9.6k-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssl-solibs-0.9.6k-i386-1.tgz

Updated packages for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-0.9.7c-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-solibs-0.9.7c-i386-1.tgz

Updated packages for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-0.9.7c-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-solibs-0.9.7c-i486-1.tgz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-0.9.7c-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-0.9.7c-i486-1.tgz


MD5 SIGNATURES:
+-------------+

Slackware 8.1 packages:
b16847083943c529ff63a07331d1818f  openssl-0.9.6k-i386-1.tgz
a371561b0f2148149abc662d02b17381  openssl-solibs-0.9.6k-i386-1.tgz

Slackware 9.0 packages:
1a45090e4e432884de48beae5dfae540  openssl-0.9.7c-i386-1.tgz
04629d814bd468b0b9e4f7da3df92752  openssl-solibs-0.9.7c-i386-1.tgz

Slackware 9.1 packages:
49dbc64a43633bedb3ff8e5be93e7c6a  openssl-0.9.7c-i486-1.tgz
7598ad83ffd12e5b8e34dcf60fb18e1d  openssl-solibs-0.9.7c-i486-1.tgz

Slackware -current packages:
49dbc64a43633bedb3ff8e5be93e7c6a  openssl-0.9.7c-i486-1.tgz
7598ad83ffd12e5b8e34dcf60fb18e1d  openssl-solibs-0.9.7c-i486-1.tgz


INSTALLATION INSTRUCTIONS:
+------------------------+

Upgrade using upgradepkg (as root):
# upgradepkg openssl-0.9.7c-i486-1.tgz openssl-solibs-0.9.7c-i486-1.tgz



+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@...ckware.com

+------------------------------------------------------------------------+
| HOW TO REMOVE YOURSELF FROM THIS MAILING LIST:                         |
+------------------------------------------------------------------------+
| Send an email to majordomo@...ckware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back.  Follow the instructions to  |
| complete the unsubscription.  Do not reply to this message to          |
| unsubscribe!                                                           |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/eijPakRjwEAQIjMRAtifAJ9emfNpGCpObxaXqVzC8XIkg9FTSgCfaz8n
h/ea1OLFkXhGFxME/PnlCDQ=
=HSN8
-----END PGP SIGNATURE-----