[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] [ MDVSA-2010:248 ] openssl
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] [ MDVSA-2010:248 ] openssl
- From: security@xxxxxxxxxxxx
- Date: Tue, 07 Dec 2010 17:39:01 +0100
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2010:248
http://www.mandriva.com/security/
_______________________________________________________________________
Package : openssl
Date : December 7, 2010
Affected: 2009.0, 2010.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
A vulnerability was discovered and corrected in openssl:
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when
SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly
prevent modification of the ciphersuite in the session cache, which
allows remote attackers to force the use of an unintended cipher
via vectors involving sniffing network traffic to discover a session
identifier (CVE-2010-4180).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2009.0:
a4b19ac2810b464392bb2f3b5292fe67
2009.0/i586/libopenssl0.9.8-0.9.8h-3.9mdv2009.0.i586.rpm
6169959e4a5f0acbdab7269ac99baa8d
2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.9mdv2009.0.i586.rpm
64195ec5f2e7868a49c280d3a32168cd
2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.9mdv2009.0.i586.rpm
7a1c151567d7f9d364a79ecd63322d47
2009.0/i586/openssl-0.9.8h-3.9mdv2009.0.i586.rpm
6e96fc588f1921571046fbc14928e5a1
2009.0/SRPMS/openssl-0.9.8h-3.9mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
a77409f3bedc0446f8eda39281dbf7a4
2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.9mdv2009.0.x86_64.rpm
feffaacd70224326c3582eb93156864b
2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.9mdv2009.0.x86_64.rpm
e2cb3f77f36b8b0a6ca214861bf79be3
2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.9mdv2009.0.x86_64.rpm
d6e667e012727d34442e23f91b005b40
2009.0/x86_64/openssl-0.9.8h-3.9mdv2009.0.x86_64.rpm
6e96fc588f1921571046fbc14928e5a1
2009.0/SRPMS/openssl-0.9.8h-3.9mdv2009.0.src.rpm
Mandriva Linux 2010.0:
86223cb60de3ea76f185425da6b299f2
2010.0/i586/libopenssl0.9.8-0.9.8k-5.4mdv2010.0.i586.rpm
7624aa325a944ee5f4898dfd3a1c4340
2010.0/i586/libopenssl0.9.8-devel-0.9.8k-5.4mdv2010.0.i586.rpm
95ac866a31973ccf4c2e6d04012e7e67
2010.0/i586/libopenssl0.9.8-static-devel-0.9.8k-5.4mdv2010.0.i586.rpm
445c417e7de8145daefedf113b343ff5
2010.0/i586/openssl-0.9.8k-5.4mdv2010.0.i586.rpm
27fc76be287e1cd06adb2725df0c4167
2010.0/SRPMS/openssl-0.9.8k-5.4mdv2010.0.src.rpm
Mandriva Linux 2010.0/X86_64:
391cb84677230e2c39708db0797b2e87
2010.0/x86_64/lib64openssl0.9.8-0.9.8k-5.4mdv2010.0.x86_64.rpm
7f251668cfd04bd1e2a634030c28929f
2010.0/x86_64/lib64openssl0.9.8-devel-0.9.8k-5.4mdv2010.0.x86_64.rpm
9110c45d54ce48c4ad0c8fe231f7f027
2010.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8k-5.4mdv2010.0.x86_64.rpm
43e7eae967aad5b140eed29dab277aa2
2010.0/x86_64/openssl-0.9.8k-5.4mdv2010.0.x86_64.rpm
27fc76be287e1cd06adb2725df0c4167
2010.0/SRPMS/openssl-0.9.8k-5.4mdv2010.0.src.rpm
Mandriva Linux 2010.1:
9cf211d5095ca7a5a82aa980d4eebd5d
2010.1/i586/libopenssl1.0.0-1.0.0a-1.6mdv2010.1.i586.rpm
788019361b199d0b6a0f3331294ac154
2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.6mdv2010.1.i586.rpm
b2372b8919a8ab458ade4ce47080f7ff
2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.6mdv2010.1.i586.rpm
cd5929de815b6eec25d1d683f4363db0
2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.6mdv2010.1.i586.rpm
60fee57d944361e4fa369412c71a59a9
2010.1/i586/openssl-1.0.0a-1.6mdv2010.1.i586.rpm
2f28a567af2f44df1fbac7006d27db5d
2010.1/SRPMS/openssl-1.0.0a-1.6mdv2010.1.src.rpm
Mandriva Linux 2010.1/X86_64:
ab021cadcaa131053ba5ac3940298f86
2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.6mdv2010.1.x86_64.rpm
a2119fefbe8cfb649e88b3faf85ffba1
2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.6mdv2010.1.x86_64.rpm
067878d8ff9ec0002c0a7653a1b87b05
2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.6mdv2010.1.x86_64.rpm
60a8142259ee202b6327e8a2c0f86755
2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.6mdv2010.1.x86_64.rpm
a4c77c129fd43f7918075fadf461fe8b
2010.1/x86_64/openssl-1.0.0a-1.6mdv2010.1.x86_64.rpm
2f28a567af2f44df1fbac7006d27db5d
2010.1/SRPMS/openssl-1.0.0a-1.6mdv2010.1.src.rpm
Corporate 4.0:
3f7610ee9ee7aa4b8d1ed3997e28d09b
corporate/4.0/i586/libopenssl0.9.7-0.9.7g-2.13.20060mlcs4.i586.rpm
25a4686ef5ca8302eebf2f1b4fe67e35
corporate/4.0/i586/libopenssl0.9.7-devel-0.9.7g-2.13.20060mlcs4.i586.rpm
c5f5a562293eae123b05a96d3ba663d7
corporate/4.0/i586/libopenssl0.9.7-static-devel-0.9.7g-2.13.20060mlcs4.i586.rpm
e50aac28cc844b0184f3203bb34fa682
corporate/4.0/i586/openssl-0.9.7g-2.13.20060mlcs4.i586.rpm
646cced4e21e4bf657254040ddbc1a47
corporate/4.0/SRPMS/openssl-0.9.7g-2.13.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
f68f167e440886222c949078044281eb
corporate/4.0/x86_64/lib64openssl0.9.7-0.9.7g-2.13.20060mlcs4.x86_64.rpm
ab7cc2cc749717199afb25c094035945
corporate/4.0/x86_64/lib64openssl0.9.7-devel-0.9.7g-2.13.20060mlcs4.x86_64.rpm
f7f9a378a4e77af084330d2206c86e5e
corporate/4.0/x86_64/lib64openssl0.9.7-static-devel-0.9.7g-2.13.20060mlcs4.x86_64.rpm
fdcc7edc730c1ec56424328cefcbdfae
corporate/4.0/x86_64/openssl-0.9.7g-2.13.20060mlcs4.x86_64.rpm
646cced4e21e4bf657254040ddbc1a47
corporate/4.0/SRPMS/openssl-0.9.7g-2.13.20060mlcs4.src.rpm
Mandriva Enterprise Server 5:
09c73809185dfb05bd8545e46bb8b215
mes5/i586/libopenssl0.9.8-0.9.8h-3.9mdvmes5.1.i586.rpm
cefb1c9e7fbc54ef678c3cbb16fb4983
mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.9mdvmes5.1.i586.rpm
1f1810faa0ec3f1cf298882752826903
mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.9mdvmes5.1.i586.rpm
48ce5b2ac3e114dd33d8274d01baf357
mes5/i586/openssl-0.9.8h-3.9mdvmes5.1.i586.rpm
487d48389d5b8bd2486e29f052749651
mes5/SRPMS/openssl-0.9.8h-3.9mdvmes5.1.src.rpm
Mandriva Enterprise Server 5/X86_64:
4ad42bf2e7beae5a935649df07c000e6
mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.9mdvmes5.1.x86_64.rpm
709be621d6080125c051d9793cb92b26
mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.9mdvmes5.1.x86_64.rpm
000098b8f9b1778bcb3ff01b504e697b
mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.9mdvmes5.1.x86_64.rpm
ab35ec2ae8b1482722baee700b16f121
mes5/x86_64/openssl-0.9.8h-3.9mdvmes5.1.x86_64.rpm
487d48389d5b8bd2486e29f052749651
mes5/SRPMS/openssl-0.9.8h-3.9mdvmes5.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFM/jI/mqjQ0CJFipgRAvhxAJ4hupGMeQ2SW/SJBOrsRXb/TmuSigCfaETn
X4x5UtqVB5mfmzjkXQQ2VNo=
=Lyfg
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/