Message-Id: <E1MmApo-0001Fi-8w@titan.mandriva.com>
Date: Fri, 11 Sep 2009 20:27:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:228 ] libneon


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:228
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : libneon
 Date    : September 10, 2009
 Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0,
           Enterprise Server 5.0, Multi Network Firewall 2.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in neon:
 
 neon before 0.28.6, when OpenSSL is used, does not properly handle
 a '\0' character in a domain name in the subject's Common Name
 (CN) field of an X.509 certificate, which allows man-in-the-middle
 attackers to spoof arbitrary SSL servers via a crafted certificate
 issued by a legitimate Certification Authority, a related issue to
 CVE-2009-2408. (CVE-2009-2474)
 
 This update provides a solution to this vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2474
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 1123e36a897efa834a3e0d36460dcc33  2008.1/i586/libneon0.24-0.24.7-21.2mdv2008.1.i586.rpm
 3684425df6598f1a7c86aed6f286d2e7  2008.1/i586/libneon0.24-devel-0.24.7-21.2mdv2008.1.i586.rpm
 ccea87a2cc2d93b87d914be1b4505a37  2008.1/i586/libneon0.24-static-devel-0.24.7-21.2mdv2008.1.i586.rpm
 ca5680df443981778142576a68d9a8b1  2008.1/i586/libneon0.26-0.26.4-5.2mdv2008.1.i586.rpm
 9b90410422324514c0b0645163118c9a  2008.1/i586/libneon0.26-devel-0.26.4-5.2mdv2008.1.i586.rpm
 ae76995f7d095331ed5773a584b2a73c  2008.1/i586/libneon0.26-static-devel-0.26.4-5.2mdv2008.1.i586.rpm 
 dc1d23f9ec9b449893456baec8b6700b  2008.1/SRPMS/libneon0.24-0.24.7-21.2mdv2008.1.src.rpm
 effe8d01bc8e9663dbe61a92849eb340  2008.1/SRPMS/libneon0.26-0.26.4-5.2mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 74220dd3794599f93a762ac96cdb4f2a  2008.1/x86_64/lib64neon0.24-0.24.7-21.2mdv2008.1.x86_64.rpm
 e357492501ef388e756780aea057aa0e  2008.1/x86_64/lib64neon0.24-devel-0.24.7-21.2mdv2008.1.x86_64.rpm
 099adbe063ff402b5f79b96aee7d28f4  2008.1/x86_64/lib64neon0.24-static-devel-0.24.7-21.2mdv2008.1.x86_64.rpm
 491e88176c331b8b33850dc4ff4cf11b  2008.1/x86_64/lib64neon0.26-0.26.4-5.2mdv2008.1.x86_64.rpm
 dd9b2e3e919f69cb10150ff0ce4c5559  2008.1/x86_64/lib64neon0.26-devel-0.26.4-5.2mdv2008.1.x86_64.rpm
 426db2bebd6206115e358b779f62f117  2008.1/x86_64/lib64neon0.26-static-devel-0.26.4-5.2mdv2008.1.x86_64.rpm 
 dc1d23f9ec9b449893456baec8b6700b  2008.1/SRPMS/libneon0.24-0.24.7-21.2mdv2008.1.src.rpm
 effe8d01bc8e9663dbe61a92849eb340  2008.1/SRPMS/libneon0.26-0.26.4-5.2mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 4f9454779e532e76d530121b2efed153  2009.0/i586/libneon0.26-0.26.4-6.2mdv2009.0.i586.rpm
 a86b602efd802fe0a90756c54a4cfee6  2009.0/i586/libneon0.26-devel-0.26.4-6.2mdv2009.0.i586.rpm
 2fbae1ec8948843b455b53463f5f216d  2009.0/i586/libneon0.26-static-devel-0.26.4-6.2mdv2009.0.i586.rpm 
 ecc22290b29644dd7459c2aefe5d5de4  2009.0/SRPMS/libneon0.26-0.26.4-6.2mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 077026afcdf0c1e1d09fe098c340a85c  2009.0/x86_64/lib64neon0.26-0.26.4-6.2mdv2009.0.x86_64.rpm
 91127afa4a80debcfcd49f0a19a0e442  2009.0/x86_64/lib64neon0.26-devel-0.26.4-6.2mdv2009.0.x86_64.rpm
 7caf316e8079d30ca90b96903ba1702a  2009.0/x86_64/lib64neon0.26-static-devel-0.26.4-6.2mdv2009.0.x86_64.rpm 
 ecc22290b29644dd7459c2aefe5d5de4  2009.0/SRPMS/libneon0.26-0.26.4-6.2mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 f94b7b03b28ebdc4ece54b601460bd4f  2009.1/i586/libneon0.26-0.26.4-6.2mdv2009.1.i586.rpm
 0ab62c5b0622e2e3cd1f78347cc04e41  2009.1/i586/libneon0.26-devel-0.26.4-6.2mdv2009.1.i586.rpm
 f340831b1373206f3f740e5d51f8c10a  2009.1/i586/libneon0.26-static-devel-0.26.4-6.2mdv2009.1.i586.rpm 
 746a811c1e5a3f119c57c2921fda7073  2009.1/SRPMS/libneon0.26-0.26.4-6.2mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 e8cc5d7d17190643ab468bd1624db6a8  2009.1/x86_64/lib64neon0.26-0.26.4-6.2mdv2009.1.x86_64.rpm
 4d2649aa3c3db0e734267c5eba3eb248  2009.1/x86_64/lib64neon0.26-devel-0.26.4-6.2mdv2009.1.x86_64.rpm
 19ca5a647425e4db9af287de0e21bb69  2009.1/x86_64/lib64neon0.26-static-devel-0.26.4-6.2mdv2009.1.x86_64.rpm 
 746a811c1e5a3f119c57c2921fda7073  2009.1/SRPMS/libneon0.26-0.26.4-6.2mdv2009.1.src.rpm

 Corporate 3.0:
 d27dbab058c8fa431ddb2d6dc0b9a274  corporate/3.0/i586/libneon0.24-0.24.7-1.1.101mdk.i586.rpm
 fae249ec7fa3c2621b120e7cea01a211  corporate/3.0/i586/libneon0.24-devel-0.24.7-1.1.101mdk.i586.rpm
 a51842a47dd9e123f9f51d2c4d82daaa  corporate/3.0/i586/libneon0.24-static-devel-0.24.7-1.1.101mdk.i586.rpm 
 6aac5b1670a6d20c6142b84ff9e96a51  corporate/3.0/SRPMS/libneon-0.24.7-1.1.101mdk.src.rpm

 Corporate 3.0/X86_64:
 9bcb2e9bbb1da24b19594fbd1738f1c2  corporate/3.0/x86_64/lib64neon0.24-0.24.7-1.1.101mdk.x86_64.rpm
 6406230ecb959c719b6bdcde4004baee  corporate/3.0/x86_64/lib64neon0.24-devel-0.24.7-1.1.101mdk.x86_64.rpm
 80330ad1bcd75f7052196cd48acb3d23  corporate/3.0/x86_64/lib64neon0.24-static-devel-0.24.7-1.1.101mdk.x86_64.rpm 
 6aac5b1670a6d20c6142b84ff9e96a51  corporate/3.0/SRPMS/libneon-0.24.7-1.1.101mdk.src.rpm

 Corporate 4.0:
 5dd641da6ce0f905dfa934eaf8a1e576  corporate/4.0/i586/libneon0.24-0.24.7-12.1mdk.i586.rpm
 1ac9cad7a7e2849428e06404a7b5f539  corporate/4.0/i586/libneon0.24-devel-0.24.7-12.1mdk.i586.rpm
 15cdf86dab35fde01dda647ae6d81246  corporate/4.0/i586/libneon0.24-static-devel-0.24.7-12.1mdk.i586.rpm
 4c83315bb3f59dbd748131e339e0129f  corporate/4.0/i586/libneon0.25-0.25.1-3.1mdk.i586.rpm
 4488e97e752f9dcfec360a5bd01be634  corporate/4.0/i586/libneon0.25-devel-0.25.1-3.1mdk.i586.rpm
 894574f2e6fcc466ae5e093d202ea4a8  corporate/4.0/i586/libneon0.25-static-devel-0.25.1-3.1mdk.i586.rpm 
 9efb81497d770a4c54be687c15ab9786  corporate/4.0/SRPMS/libneon0.24-0.24.7-12.1mdk.src.rpm
 23a233753b854143302a76f4982e42d7  corporate/4.0/SRPMS/libneon0.25-0.25.1-3.1mdk.src.rpm

 Corporate 4.0/X86_64:
 abbd0b575fab4521cf4c68258844e63f  corporate/4.0/x86_64/lib64neon0.24-0.24.7-12.1mdk.x86_64.rpm
 6d9a76ead78b506c8c1ccccf82ff95ae  corporate/4.0/x86_64/lib64neon0.24-devel-0.24.7-12.1mdk.x86_64.rpm
 e0d9b14e0794a3cd8c7f387f45252983  corporate/4.0/x86_64/lib64neon0.24-static-devel-0.24.7-12.1mdk.x86_64.rpm
 9bf7d5343eefa15518a8d8347d7a7390  corporate/4.0/x86_64/lib64neon0.25-0.25.1-3.1mdk.x86_64.rpm
 f874157bdb9dae35bbaf98cc6fdf64fc  corporate/4.0/x86_64/lib64neon0.25-devel-0.25.1-3.1mdk.x86_64.rpm
 07e03b594e6cc03e6c97104beb6d8147  corporate/4.0/x86_64/lib64neon0.25-static-devel-0.25.1-3.1mdk.x86_64.rpm 
 9efb81497d770a4c54be687c15ab9786  corporate/4.0/SRPMS/libneon0.24-0.24.7-12.1mdk.src.rpm
 23a233753b854143302a76f4982e42d7  corporate/4.0/SRPMS/libneon0.25-0.25.1-3.1mdk.src.rpm

 Mandriva Enterprise Server 5:
 f5a94acdb8dbd9131202074428dead73  mes5/i586/libneon0.26-0.26.4-6.2mdvmes5.i586.rpm
 4de9f68238916c28847f4c74eac60b25  mes5/i586/libneon0.26-devel-0.26.4-6.2mdvmes5.i586.rpm
 b1a8f226dce843b68be9970081984585  mes5/i586/libneon0.26-static-devel-0.26.4-6.2mdvmes5.i586.rpm 
 a3202bc64e0648ec9787f6e3ad82caaf  mes5/SRPMS/libneon0.26-0.26.4-6.2mdv2009.0.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 2be4bf50ead3eb78490aa21386dbe2f2  mes5/x86_64/lib64neon0.26-0.26.4-6.2mdvmes5.x86_64.rpm
 2705e63e4d191c667d788b4bb69eb01c  mes5/x86_64/lib64neon0.26-devel-0.26.4-6.2mdvmes5.x86_64.rpm
 7419c8025a4ac445df90a73efd625f96  mes5/x86_64/lib64neon0.26-static-devel-0.26.4-6.2mdvmes5.x86_64.rpm 
 a3202bc64e0648ec9787f6e3ad82caaf  mes5/SRPMS/libneon0.26-0.26.4-6.2mdv2009.0.src.rpm

 Multi Network Firewall 2.0:
 b1614b9804645e49a3ab48e9eed87ead  mnf/2.0/i586/libneon0.24-0.24.7-1.1.101mdk.i586.rpm
 6e244da945cc42ee5a030df1635df4f3  mnf/2.0/i586/libneon0.24-devel-0.24.7-1.1.101mdk.i586.rpm
 257cabc3d460426a88cf290e5a6bee97  mnf/2.0/i586/libneon0.24-static-devel-0.24.7-1.1.101mdk.i586.rpm 
 5cb2af5b920ccfcdbe1050af2999d419  mnf/2.0/SRPMS/libneon-0.24.7-1.1.101mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKqmgLmqjQ0CJFipgRAvGHAJ45CNenXTIAT1JEfRHMYV8qf+R7YACglETn
xUeqM089Bi8iv7X2IMb1prs=
=5TgE
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists