bugtraq - [SECURITY] [DSA 2950-1] openssl security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20140605115134.GA2278@pisco.westfalen.local>
Date: Thu, 5 Jun 2014 13:51:34 +0200
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 2950-1] openssl security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2950-1                   security@...ian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
June 05, 2014                          http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openssl
CVE ID         : CVE-2014-0195 CVE-2014-0221 CVE-2014-0224 CVE-2014-3470

Multiple vulnerabilities have been discovered in OpenSSL:

CVE-2014-0195

    Jueri Aedla discovered that a buffer overflow in processing DTLS
    fragments could lead to the execution of arbitrary code or denial
    of service.

CVE-2014-0221

    Imre Rad discovered the processing of DTLS hello packets is 
    susceptible to denial of service.

CVE-2014-0224

    KIKUCHI Masashi discovered that carefully crafted handshakes can
    force the use of weak keys, resulting in potential man-in-the-middle
    attacks.

CVE-2014-3470

    Felix Groebert and Ivan Fratric discovered that the implementation of
    anonymous ECDH ciphersuites is suspectible to denial of service.

Additional information can be found at 
http://www.openssl.org/news/secadv_20140605.txt

For the stable distribution (wheezy), these problems have been fixed in
version 1.0.1e-2+deb7u10. All applications linked to openssl need to
be restarted. You can use the tool checkrestart from the package
debian-goodies to detect affected programs or reboot your system. There's
also a forthcoming security update for the Linux kernel later the day
(CVE-2014-3153), so you need to reboot anyway. Perfect timing, isn't it?

For the unstable distribution (sid), these problems will be fixed soon.

We recommend that you upgrade your openssl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJTkFmLAAoJEBDCk7bDfE42KeEP/2arDOfqKC72VOtJ+T7jwjTP
x4vdXKCFvDknNTs4sf4/BPa1UeNu2xANWl9UcpueE9UKInuGP61+UeAuyAjBNHiz
GOz1zQ1DvqK71JmlIvK4bnTAnwTHDOwvlNABGPWiahnzhbLDN2eFnNLTT3S33FL7
DDuD5UXvtroNYcPF1N7Uvze3oG1rBIilrX+lmFE+I52v4+TRZJKgUfuydX3OO+z7
gRGsI5nEFff4xe32N32AVh90yf0UbR783BBAW+NZuxsmRFOJ06CvpjmAuycAk33X
1IOkCwxSXtWOlOsi1k1sTK0EvDyB4bY1NSMqNUXgxmZ/IQld25CO4lRZCJj8QBA6
DhFRfEg+70anqZ6uI5+DvG8ichNNpPg8CKKNTv2aGUrKVjFT2jzN6L/d3wBXBqCF
TkDemP/MKu31dU+KmR8TSG1q08satChdbHHdila3wkjOy1PdJF7ksKUjkRq0mMW2
hn/V60Dc0KMZ1O4cj8b369Ngt57ma9wdgNKzD7GNnqucEV2RT7pwSSVAfCUzPopn
KAo3z4SQAyR1HOQP17yH7XoVlwLcpo8Orqvnktz2D9M2ehsopjfNEvLaCkaRRO1t
1IQwbDdjCEStLwbFqdxQA4RfpQU0Fhq01AuuA7/exy5yZrq8So6NarGdpnesTqGa
tsd2gjmQwj7gbB+qL7zk
=MUFq
-----END PGP SIGNATURE-----