| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20060928153004.GB22562@piware.de>
Date: Thu, 28 Sep 2006 17:30:04 +0200
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-353-1] openssl vulnerabilities
===========================================================
Ubuntu Security Notice USN-353-1 September 28, 2006
openssl vulnerabilities
CVE-2006-2937, CVE-2006-2940, CVE-2006-3738, CVE-2006-4343
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 5.04
Ubuntu 5.10
Ubuntu 6.06 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.04:
libssl0.9.7 0.9.7e-3ubuntu0.4
Ubuntu 5.10:
libssl0.9.7 0.9.7g-1ubuntu1.3
Ubuntu 6.06 LTS:
libssl0.9.8 0.9.8a-7ubuntu0.2
After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Details follow:
Dr. Henson of the OpenSSL core team and Open Network Security
discovered a mishandled error condition in the ASN.1 parser. By
sending specially crafted packet data, a remote attacker could exploit
this to trigger an infinite loop, which would render the service
unusable and consume all available system memory. (CVE-2006-2937)
Certain types of public key could take disproportionate amounts of
time to process. The library now limits the maximum key exponent size
to avoid Denial of Service attacks. (CVE-2006-2940)
Tavis Ormandy and Will Drewry of the Google Security Team discovered a
buffer overflow in the SSL_get_shared_ciphers() function. By sending
specially crafted packets to applications that use this function (like
Exim, MySQL, or the openssl command line tool), a remote attacker
could exploit this to execute arbitrary code with the server's
privileges. (CVE-2006-3738)
Tavis Ormandy and Will Drewry of the Google Security Team reported
that the get_server_hello() function did not sufficiently check the
client's session certificate. This could be exploited to crash clients
by remote attackers sending specially crafted SSL responses.
(CVE-2006-4343)
Updated packages for Ubuntu 5.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.4.diff.gz
Size/MD5: 31608 073a299c1050059dddc16818fecd56c5
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.4.dsc
Size/MD5: 645 eb30a98f7f176954987a8642bcda2ae7
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e.orig.tar.gz
Size/MD5: 3043231 a8777164bca38d84e5eb2b1535223474
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7e-3ubuntu0.4_amd64.udeb
Size/MD5: 495242 d51b7cb655f0cd4010160d7e8546da41
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7e-3ubuntu0.4_amd64.deb
Size/MD5: 2694098 3c87855cd1a4a2bb12dd1fef0acdca78
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7e-3ubuntu0.4_amd64.deb
Size/MD5: 770334 e0dff277aafa1f35fcc7995576374922
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.4_amd64.deb
Size/MD5: 904128 70a46effaa0b51162f9d84c609bba596
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7e-3ubuntu0.4_i386.udeb
Size/MD5: 433488 f1bd01ac7dd85f10cd5c32d6d78cb514
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7e-3ubuntu0.4_i386.deb
Size/MD5: 2493770 5369e13ba790cecbff0854a0d173d11a
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7e-3ubuntu0.4_i386.deb
Size/MD5: 2243328 62d80313f7ffdb047878a12687e5d689
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.4_i386.deb
Size/MD5: 901520 3791cb1125bde1a315955023c777e2ae
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7e-3ubuntu0.4_powerpc.udeb
Size/MD5: 499458 ec8af8b5ee0eaeb859a232e8a233b0dd
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7e-3ubuntu0.4_powerpc.deb
Size/MD5: 2774934 15270e8e78df08a6b7b5be55dc3d6553
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7e-3ubuntu0.4_powerpc.deb
Size/MD5: 779888 19a6e2d00d895845f556c44e044151f9
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7e-3ubuntu0.4_powerpc.deb
Size/MD5: 908598 9b0fa35557f76a6b24de199e3323541c
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7g-1ubuntu1.3.diff.gz
Size/MD5: 32295 def7ac70ca1bc85e0c4ebbd4260a4461
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7g-1ubuntu1.3.dsc
Size/MD5: 657 0b1769211fafefd21cc37c07a932a714
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7g.orig.tar.gz
Size/MD5: 3132217 991615f73338a571b6a1be7d74906934
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7g-1ubuntu1.3_amd64.udeb
Size/MD5: 499030 f8b4eac9e1bf96e10f8c30eab69649dd
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7g-1ubuntu1.3_amd64.deb
Size/MD5: 2700532 2cd3f1e6ce79941b8946a80e78dbda64
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7g-1ubuntu1.3_amd64.deb
Size/MD5: 773856 ee733077d079b9e36da96b795acbdc29
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7g-1ubuntu1.3_amd64.deb
Size/MD5: 913582 de9d0df5743ac33192195b94d063dc6c
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7g-1ubuntu1.3_i386.udeb
Size/MD5: 431028 61d40d649af32133db15ec53918caa4a
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7g-1ubuntu1.3_i386.deb
Size/MD5: 2480762 653bd5d137e0dc2ad6fc74491fd0fbb9
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7g-1ubuntu1.3_i386.deb
Size/MD5: 2204582 677d877964154251d8780b169688a060
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7g-1ubuntu1.3_i386.deb
Size/MD5: 904888 5079b31ec8fffa99838c43e42e968990
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7g-1ubuntu1.3_powerpc.udeb
Size/MD5: 476060 6460459d1e4814f183a89cf81ecf022c
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7g-1ubuntu1.3_powerpc.deb
Size/MD5: 2657180 0fde1af2915b4693664a9e74a2ed8601
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7g-1ubuntu1.3_powerpc.deb
Size/MD5: 752946 77a8a8501ff4ad35266447a38ada5d13
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7g-1ubuntu1.3_powerpc.deb
Size/MD5: 910630 126076de0fe5f7693953276c7c668971
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.7-udeb_0.9.7g-1ubuntu1.3_sparc.udeb
Size/MD5: 452356 f255548c1df1fe1f8e895ebcb3df6b81
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.7g-1ubuntu1.3_sparc.deb
Size/MD5: 2570856 5bd4aea0262f6603cd8dcfe54e4c5c84
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.7_0.9.7g-1ubuntu1.3_sparc.deb
Size/MD5: 1792562 376e9010e9be775faccc9e1f350e6ab9
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.7g-1ubuntu1.3_sparc.deb
Size/MD5: 918608 424c15da9d050abcb50bf8bbe460a201
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8a-7ubuntu0.2.diff.gz
Size/MD5: 38612 7c8d54fe8b0a7f3fd04973d0caf4e561
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8a-7ubuntu0.2.dsc
Size/MD5: 816 11829550f1f01bb297687320de351567
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8a.orig.tar.gz
Size/MD5: 3271435 1d16c727c10185e4d694f87f5e424ee1
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8a-7ubuntu0.2_amd64.udeb
Size/MD5: 571660 3f1e1fb3a1d647e89e8d2c8957ac7515
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8a-7ubuntu0.2_amd64.deb
Size/MD5: 2166962 b4dc05821c8e0257f2de1f66d60fe76b
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8a-7ubuntu0.2_amd64.deb
Size/MD5: 1681664 85a9864fd04f3148d80debfe62baf27e
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8a-7ubuntu0.2_amd64.deb
Size/MD5: 874726 b745ed4bc29c6ef1e6f04843da7075f4
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8a-7ubuntu0.2_amd64.deb
Size/MD5: 984430 6c44bb70358de400212abdb8603c632b
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8a-7ubuntu0.2_i386.udeb
Size/MD5: 509398 d003af0377dd2c4626c8a2968e88dec6
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8a-7ubuntu0.2_i386.deb
Size/MD5: 2023488 33d7fb4e61731e6a3d3696035e5e7475
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8a-7ubuntu0.2_i386.deb
Size/MD5: 5049880 643b1bd41b95d9b8d5e7503fa877095a
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8a-7ubuntu0.2_i386.deb
Size/MD5: 2594328 0d883c64b2eed5a87b5251099d571b9f
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8a-7ubuntu0.2_i386.deb
Size/MD5: 975820 e2fb9756f9be6a9c6dcc8440722cbae0
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8a-7ubuntu0.2_powerpc.udeb
Size/MD5: 557832 0e2ab74f6eb2edaede39a75708a0ba85
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8a-7ubuntu0.2_powerpc.deb
Size/MD5: 2180720 48ab01b68fe292838283e670b200f71e
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8a-7ubuntu0.2_powerpc.deb
Size/MD5: 1726256 8969623cd03454d23d6a1377bd7a84a6
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8a-7ubuntu0.2_powerpc.deb
Size/MD5: 861072 b2657f1e3f44972cc4847e558101fac0
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8a-7ubuntu0.2_powerpc.deb
Size/MD5: 979948 131b80f74dbecc0bbf7612a1d75762dd
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8a-7ubuntu0.2_sparc.udeb
Size/MD5: 530804 394500b55746ee58bd74dbd40e4cc754
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8a-7ubuntu0.2_sparc.deb
Size/MD5: 2092366 b3519eafe025f19f0bd1abc1b8305865
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8a-7ubuntu0.2_sparc.deb
Size/MD5: 3940942 9ff4a8eddbd8685dccfd74a376e0d9dd
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8a-7ubuntu0.2_sparc.deb
Size/MD5: 2090730 7a98b80bfffca5cf2435df0835a37f27
http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8a-7ubuntu0.2_sparc.deb
Size/MD5: 987898 0f7f8fb86af538d8828149545124d0d2
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists