Message-Id: <E1PQ0ZB-0006v5-FF@titan.mandriva.com>
Date: Tue, 07 Dec 2010 17:39:01 +0100
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:248 ] openssl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:248
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : openssl
 Date    : December 7, 2010
 Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability was discovered and corrected in openssl:
 
 OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when
 SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly
 prevent modification of the ciphersuite in the session cache, which
 allows remote attackers to force the use of an unintended cipher
 via vectors involving sniffing network traffic to discover a session
 identifier (CVE-2010-4180).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 a4b19ac2810b464392bb2f3b5292fe67  2009.0/i586/libopenssl0.9.8-0.9.8h-3.9mdv2009.0.i586.rpm
 6169959e4a5f0acbdab7269ac99baa8d  2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.9mdv2009.0.i586.rpm
 64195ec5f2e7868a49c280d3a32168cd  2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.9mdv2009.0.i586.rpm
 7a1c151567d7f9d364a79ecd63322d47  2009.0/i586/openssl-0.9.8h-3.9mdv2009.0.i586.rpm 
 6e96fc588f1921571046fbc14928e5a1  2009.0/SRPMS/openssl-0.9.8h-3.9mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 a77409f3bedc0446f8eda39281dbf7a4  2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.9mdv2009.0.x86_64.rpm
 feffaacd70224326c3582eb93156864b  2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.9mdv2009.0.x86_64.rpm
 e2cb3f77f36b8b0a6ca214861bf79be3  2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.9mdv2009.0.x86_64.rpm
 d6e667e012727d34442e23f91b005b40  2009.0/x86_64/openssl-0.9.8h-3.9mdv2009.0.x86_64.rpm 
 6e96fc588f1921571046fbc14928e5a1  2009.0/SRPMS/openssl-0.9.8h-3.9mdv2009.0.src.rpm

 Mandriva Linux 2010.0:
 86223cb60de3ea76f185425da6b299f2  2010.0/i586/libopenssl0.9.8-0.9.8k-5.4mdv2010.0.i586.rpm
 7624aa325a944ee5f4898dfd3a1c4340  2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.4mdv2010.0.i586.rpm
 95ac866a31973ccf4c2e6d04012e7e67  2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.4mdv2010.0.i586.rpm
 445c417e7de8145daefedf113b343ff5  2010.0/i586/openssl-0.9.8k-5.4mdv2010.0.i586.rpm 
 27fc76be287e1cd06adb2725df0c4167  2010.0/SRPMS/openssl-0.9.8k-5.4mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 391cb84677230e2c39708db0797b2e87  2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.4mdv2010.0.x86_64.rpm
 7f251668cfd04bd1e2a634030c28929f  2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.4mdv2010.0.x86_64.rpm
 9110c45d54ce48c4ad0c8fe231f7f027  2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.4mdv2010.0.x86_64.rpm
 43e7eae967aad5b140eed29dab277aa2  2010.0/x86_64/openssl-0.9.8k-5.4mdv2010.0.x86_64.rpm 
 27fc76be287e1cd06adb2725df0c4167  2010.0/SRPMS/openssl-0.9.8k-5.4mdv2010.0.src.rpm

 Mandriva Linux 2010.1:
 9cf211d5095ca7a5a82aa980d4eebd5d  2010.1/i586/libopenssl1.0.0-1.0.0a-1.6mdv2010.1.i586.rpm
 788019361b199d0b6a0f3331294ac154  2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.6mdv2010.1.i586.rpm
 b2372b8919a8ab458ade4ce47080f7ff  2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.6mdv2010.1.i586.rpm
 cd5929de815b6eec25d1d683f4363db0  2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.6mdv2010.1.i586.rpm
 60fee57d944361e4fa369412c71a59a9  2010.1/i586/openssl-1.0.0a-1.6mdv2010.1.i586.rpm 
 2f28a567af2f44df1fbac7006d27db5d  2010.1/SRPMS/openssl-1.0.0a-1.6mdv2010.1.src.rpm

 Mandriva Linux 2010.1/X86_64:
 ab021cadcaa131053ba5ac3940298f86  2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.6mdv2010.1.x86_64.rpm
 a2119fefbe8cfb649e88b3faf85ffba1  2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.6mdv2010.1.x86_64.rpm
 067878d8ff9ec0002c0a7653a1b87b05  2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.6mdv2010.1.x86_64.rpm
 60a8142259ee202b6327e8a2c0f86755  2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.6mdv2010.1.x86_64.rpm
 a4c77c129fd43f7918075fadf461fe8b  2010.1/x86_64/openssl-1.0.0a-1.6mdv2010.1.x86_64.rpm 
 2f28a567af2f44df1fbac7006d27db5d  2010.1/SRPMS/openssl-1.0.0a-1.6mdv2010.1.src.rpm

 Corporate 4.0:
 3f7610ee9ee7aa4b8d1ed3997e28d09b  corporate/4.0/i586/libopenssl0.9.7-0.9.7g-2.13.20060mlcs4.i586.rpm
 25a4686ef5ca8302eebf2f1b4fe67e35  corporate/4.0/i586/libopenssl0.9.7-devel-0.9.7g-2.13.20060mlcs4.i586.rpm
 c5f5a562293eae123b05a96d3ba663d7  corporate/4.0/i586/libopenssl0.9.7-static-devel-0.9.7g-2.13.20060mlcs4.i586.rpm
 e50aac28cc844b0184f3203bb34fa682  corporate/4.0/i586/openssl-0.9.7g-2.13.20060mlcs4.i586.rpm 
 646cced4e21e4bf657254040ddbc1a47  corporate/4.0/SRPMS/openssl-0.9.7g-2.13.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 f68f167e440886222c949078044281eb  corporate/4.0/x86_64/lib64openssl0.9.7-0.9.7g-2.13.20060mlcs4.x86_64.rpm
 ab7cc2cc749717199afb25c094035945  corporate/4.0/x86_64/lib64openssl0.9.7-devel-0.9.7g-2.13.20060mlcs4.x86_64.rpm
 f7f9a378a4e77af084330d2206c86e5e  corporate/4.0/x86_64/lib64openssl0.9.7-static-devel-0.9.7g-2.13.20060mlcs4.x86_64.rpm
 fdcc7edc730c1ec56424328cefcbdfae  corporate/4.0/x86_64/openssl-0.9.7g-2.13.20060mlcs4.x86_64.rpm 
 646cced4e21e4bf657254040ddbc1a47  corporate/4.0/SRPMS/openssl-0.9.7g-2.13.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 09c73809185dfb05bd8545e46bb8b215  mes5/i586/libopenssl0.9.8-0.9.8h-3.9mdvmes5.1.i586.rpm
 cefb1c9e7fbc54ef678c3cbb16fb4983  mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.9mdvmes5.1.i586.rpm
 1f1810faa0ec3f1cf298882752826903  mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.9mdvmes5.1.i586.rpm
 48ce5b2ac3e114dd33d8274d01baf357  mes5/i586/openssl-0.9.8h-3.9mdvmes5.1.i586.rpm 
 487d48389d5b8bd2486e29f052749651  mes5/SRPMS/openssl-0.9.8h-3.9mdvmes5.1.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 4ad42bf2e7beae5a935649df07c000e6  mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.9mdvmes5.1.x86_64.rpm
 709be621d6080125c051d9793cb92b26  mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.9mdvmes5.1.x86_64.rpm
 000098b8f9b1778bcb3ff01b504e697b  mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.9mdvmes5.1.x86_64.rpm
 ab35ec2ae8b1482722baee700b16f121  mes5/x86_64/openssl-0.9.8h-3.9mdvmes5.1.x86_64.rpm 
 487d48389d5b8bd2486e29f052749651  mes5/SRPMS/openssl-0.9.8h-3.9mdvmes5.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM/jI/mqjQ0CJFipgRAvhxAJ4hupGMeQ2SW/SJBOrsRXb/TmuSigCfaETn
X4x5UtqVB5mfmzjkXQQ2VNo=
=Lyfg
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists