bugtraq - [ MDKSA-2006:161 ] - Updated openssl packages fix vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1GL7S0-000213-AH@mercury.mandriva.com>
Date: Wed,  6 Sep 2006 18:09:00 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2006:161 ] - Updated openssl packages fix vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:161
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : openssl
 Date    : September 6, 2006
 Affected: 2006.0, Corporate 3.0, Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 Daniel Bleichenbacher recently described an attack on PKCS #1 v1.5
 signatures where an RSA key with a small exponent used could be
 vulnerable to forgery of a PKCS #1 v1.5 signature signed by that
 key.
 
 Any software using OpenSSL to verify X.509 certificates is potentially
 vulnerable to this issue, as well as any other use of PKCS #1 v1.5,
 including software uses OpenSSL for SSL or TLS.
 
 Updated packages are patched to address this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339
 http://www.openssl.org/news/secadv_20060905.txt
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 8c5769bf04f65ba4c871556156e83a24  2006.0/RPMS/libopenssl0.9.7-0.9.7g-2.3.20060mdk.i586.rpm
 f4f595e10bc3ca3f075847ac25e5d78b  2006.0/RPMS/libopenssl0.9.7-devel-0.9.7g-2.3.20060mdk.i586.rpm
 448ca33d2bf74e29650a72c4324ee26d  2006.0/RPMS/libopenssl0.9.7-static-devel-0.9.7g-2.3.20060mdk.i586.rpm
 1d084addaaed6cf3933e21a59c831f37  2006.0/RPMS/openssl-0.9.7g-2.3.20060mdk.i586.rpm
 fffdadefbb4571005a0c48495eb9c112  2006.0/SRPMS/openssl-0.9.7g-2.3.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 c62f2df7b05b041498f0b8e335265d4f  x86_64/2006.0/RPMS/lib64openssl0.9.7-0.9.7g-2.3.20060mdk.x86_64.rpm
 3a113e1603e4827ef5ce2cc3e6fd30a8  x86_64/2006.0/RPMS/lib64openssl0.9.7-devel-0.9.7g-2.3.20060mdk.x86_64.rpm
 b991400c2bc6c2f1886ed8163fc64c46  x86_64/2006.0/RPMS/lib64openssl0.9.7-static-devel-0.9.7g-2.3.20060mdk.x86_64.rpm
 a1bec4a4d34fb73ea5fcd72e22a4f291  x86_64/2006.0/RPMS/openssl-0.9.7g-2.3.20060mdk.x86_64.rpm
 fffdadefbb4571005a0c48495eb9c112  x86_64/2006.0/SRPMS/openssl-0.9.7g-2.3.20060mdk.src.rpm

 Corporate 3.0:
 89b73fa8deec7e2b87b2dc29ad854420  corporate/3.0/RPMS/libopenssl0.9.7-0.9.7c-3.5.C30mdk.i586.rpm
 fad4d18975f6eba4b0534fe8b1237512  corporate/3.0/RPMS/libopenssl0.9.7-devel-0.9.7c-3.5.C30mdk.i586.rpm
 3755fdc390b94c4fd3e3ccbb69e27fa4  corporate/3.0/RPMS/libopenssl0.9.7-static-devel-0.9.7c-3.5.C30mdk.i586.rpm
 f1cbc11423cc40e1421b781638f1910d  corporate/3.0/RPMS/openssl-0.9.7c-3.5.C30mdk.i586.rpm
 2ecc834f99eceafe3567e8ed0e9277e3  corporate/3.0/SRPMS/openssl-0.9.7c-3.5.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 f65a08626dcc23531a30f009ca6a8b52  x86_64/corporate/3.0/RPMS/lib64openssl0.9.7-0.9.7c-3.5.C30mdk.x86_64.rpm
 67ac445d3ad9c1e2d19f4da624e6091f  x86_64/corporate/3.0/RPMS/lib64openssl0.9.7-devel-0.9.7c-3.5.C30mdk.x86_64.rpm
 70b179ba036cad4bd59d79716dd0af41  x86_64/corporate/3.0/RPMS/lib64openssl0.9.7-static-devel-0.9.7c-3.5.C30mdk.x86_64.rpm
 133be57ba3ba96ca84a2d09cf661ddb8  x86_64/corporate/3.0/RPMS/openssl-0.9.7c-3.5.C30mdk.x86_64.rpm
 2ecc834f99eceafe3567e8ed0e9277e3  x86_64/corporate/3.0/SRPMS/openssl-0.9.7c-3.5.C30mdk.src.rpm

 Multi Network Firewall 2.0:
 9c361b601f34404e9d5809a726005303  mnf/2.0/RPMS/libopenssl0.9.7-0.9.7c-3.5.M20mdk.i586.rpm
 aae1f0dcdb8c3f41c417f3f4cc823363  mnf/2.0/RPMS/libopenssl0.9.7-devel-0.9.7c-3.5.M20mdk.i586.rpm
 d71945758cd4cab08bba725bc7086181  mnf/2.0/RPMS/libopenssl0.9.7-static-devel-0.9.7c-3.5.M20mdk.i586.rpm
 1584f0ecda9e2a57a1c8f848e8422049  mnf/2.0/RPMS/openssl-0.9.7c-3.5.M20mdk.i586.rpm
 efe79e9da865fdae6fa4d1bf377fb27e  mnf/2.0/SRPMS/openssl-0.9.7c-3.5.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE/zXomqjQ0CJFipgRAqraAJ9dQKFCKZSs2+wIddQYrsrir0XI7ACffXU5
4LAKvCmOVrwEbNgrZUVjHwU=
=6ziA
-----END PGP SIGNATURE-----