full-disclosure - [ MDVSA-2010:238 ] openssl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1PIlMW-0005gF-N3@titan.mandriva.com>
Date: Wed, 17 Nov 2010 18:00:00 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:238 ] openssl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:238
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : openssl
 Date    : November 17, 2010
 Affected: 2009.0, 2010.0, 2010.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability was discovered in openssl that causes a race condition
 within the TLS extension parsing code and which can be exploited to
 cause a heap-based buffer overflow (CVE-2010-3864).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3864
 http://openssl.org/news/secadv_20101116.txt
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 b32e4b6e6b901d72fe4aa24bd0f41f9b  2009.0/i586/libopenssl0.9.8-0.9.8h-3.8mdv2009.0.i586.rpm
 f55512826ad63a1c9c4b60fad54292ac  2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.8mdv2009.0.i586.rpm
 eb005af48a71b807ef387f4c54eedd6f  2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.8mdv2009.0.i586.rpm
 ed01c1d0ea3fdecc8ba3331541d18d9a  2009.0/i586/openssl-0.9.8h-3.8mdv2009.0.i586.rpm 
 a5b43d482e633af8952e7e04f8d7b56e  2009.0/SRPMS/openssl-0.9.8h-3.8mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 007dedca099e812b7b461e720ef5e6f1  2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.8mdv2009.0.x86_64.rpm
 293194a028c940a27d11549ef84ff182  2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.8mdv2009.0.x86_64.rpm
 6b1c8ced8640b51bf25761c127b3ed20  2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.8mdv2009.0.x86_64.rpm
 76bbe5d36d9887cbc753b267b6d3a608  2009.0/x86_64/openssl-0.9.8h-3.8mdv2009.0.x86_64.rpm 
 a5b43d482e633af8952e7e04f8d7b56e  2009.0/SRPMS/openssl-0.9.8h-3.8mdv2009.0.src.rpm

 Mandriva Linux 2010.0:
 b92acd82153b8987f0bcdb0e277c6f0e  2010.0/i586/libopenssl0.9.8-0.9.8k-5.3mdv2010.0.i586.rpm
 d780ab4e0e80a66b105f72e41a4d5b54  2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.3mdv2010.0.i586.rpm
 8faae39210b0c366f619cdb71b1a7321  2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.3mdv2010.0.i586.rpm
 2247e3b7bff72998d841d650ba25960a  2010.0/i586/openssl-0.9.8k-5.3mdv2010.0.i586.rpm 
 2c2a297e1c568ef69502064578516f0f  2010.0/SRPMS/openssl-0.9.8k-5.3mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 331d3064412c7b73baed5d54e7262f51  2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.3mdv2010.0.x86_64.rpm
 2e90f43a521e108a8adbde35a058d7b9  2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.3mdv2010.0.x86_64.rpm
 7d102f6bf8bb201654aa518e3b73a27f  2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.3mdv2010.0.x86_64.rpm
 4b7ad813fd5fdd5785bd94eb3a951244  2010.0/x86_64/openssl-0.9.8k-5.3mdv2010.0.x86_64.rpm 
 2c2a297e1c568ef69502064578516f0f  2010.0/SRPMS/openssl-0.9.8k-5.3mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 8310ac6aa860087de6992e618460f279  2010.1/i586/libopenssl1.0.0-1.0.0a-1.5mdv2010.1.i586.rpm
 7e7719b1b5c2f91a6eadfab9dd696b8f  2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.5mdv2010.1.i586.rpm
 5b5aa8939c69c69c2ab49145aca37173  2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.5mdv2010.1.i586.rpm
 0e6bd59c1d6b2c459acc5c4d0851246a  2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.5mdv2010.1.i586.rpm
 de46046e9b1e033cccd668b32b70972c  2010.1/i586/openssl-1.0.0a-1.5mdv2010.1.i586.rpm 
 f6059c72297b6510fa4c816db6742a64  2010.1/SRPMS/openssl-1.0.0a-1.5mdv2010.1.src.rpm

 Mandriva Linux 2010.1/X86_64:
 c792f3d19c1f9ff50c801feccd600319  2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.5mdv2010.1.x86_64.rpm
 7f3a6b125fc145e17c140218f3b48a92  2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.5mdv2010.1.x86_64.rpm
 e5f35fbeadb2f765607325f960de621e  2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.5mdv2010.1.x86_64.rpm
 27a8dee6459e0830be1e907f082d25a2  2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.5mdv2010.1.x86_64.rpm
 4b7863a6c8b883f385613bb7a49af128  2010.1/x86_64/openssl-1.0.0a-1.5mdv2010.1.x86_64.rpm 
 f6059c72297b6510fa4c816db6742a64  2010.1/SRPMS/openssl-1.0.0a-1.5mdv2010.1.src.rpm

 Mandriva Enterprise Server 5:
 fef62b69a582a93e821a2d802fb4faee  mes5/i586/libopenssl0.9.8-0.9.8h-3.8mdvmes5.1.i586.rpm
 fe3c0cf3596d90cc3be37a944df1753b  mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.8mdvmes5.1.i586.rpm
 d5a269adf63ee6d4ce21ea651e208180  mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.8mdvmes5.1.i586.rpm
 e410f94c6d8c08270aa1edd5aeb7c177  mes5/i586/openssl-0.9.8h-3.8mdvmes5.1.i586.rpm 
 aaa38cecee165e165beace7e0b02ecdf  mes5/SRPMS/openssl-0.9.8h-3.8mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 ebec7b3044ee3b3b0ab6c455741e5782  mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.8mdvmes5.1.x86_64.rpm
 0c201edd531dd53a541739bf6db7f276  mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.8mdvmes5.1.x86_64.rpm
 83a690e504f6470ffc4bce428ff09199  mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.8mdvmes5.1.x86_64.rpm
 fcef579e52e20393ffd2bbae00b602a8  mes5/x86_64/openssl-0.9.8h-3.8mdvmes5.1.x86_64.rpm 
 aaa38cecee165e165beace7e0b02ecdf  mes5/SRPMS/openssl-0.9.8h-3.8mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM49pvmqjQ0CJFipgRAs5xAKDhGJdpzq9ZF6TvhezjZR8zmOQAngCggDa1
vAfiUtuiMqw0BDS3V2tLk/I=
=hDGj
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/