SOT Linux Advisory: openssl

[ Thanks to SOT Security Team for this link. ]

---------------------------------------------------------------------
                   SOT Linux Security Advisory

Subject:           Updated openssl package for SOT Linux 2002
Advisory ID:       SLSA-2002:10
Date:              Thursday, August 1, 2002
Product:           SOT Linux 2002
---------------------------------------------------------------------

1. Problem description

All four of these are potentially remotely exploitable.

1. The client master key in SSL2 could be oversized and overrun a
   buffer. This vulnerability was also independently discovered by
   consultants at Neohapsis (http://www.neohapsis.com/) who have also
   demonstrated that the vulerability is exploitable. Exploit code is
   NOT available at this time.

2. The session ID supplied to a client in SSL3 could be oversized and
   overrun a buffer.

3. The master key supplied to an SSL3 server could be oversized and
   overrun a stack-based buffer. This issues only affects OpenSSL
   0.9.7 before 0.9.7-beta3 with Kerberos enabled.

4. Various buffers for ASCII representations of integers were too
   small on 64 bit platforms.




2. Updated packages

SOT Linux 2002 Desktop:

i386:
ftp://ftp.sot.com/updates/2002/Desktop/i386/openssl-0.9.6b-15.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2002/Desktop/SRPMS/openssl-0.9.6b-15.src.rpm


SOT Linux 2002 Server:

i386:
ftp://ftp.sot.com/updates/2002/Server/i386/openssl-0.9.6b-15.i386.rpm

SRPMS:
ftp://ftp.sot.com/updates/2002/Server/SRPMS/openssl-0.9.6b-15.src.rpm


3. Upgrading package

Use up2date to automatically upgrade the fixed packages.

If you want to upgrade manually, download the updated package from
the SOT Linux FTP site (use the links above) or from one of our mirrors.
The list of mirrors can be obtained at www.sot.com/en/linux

Update the package with the following command:
rpm -Uvh 


4. Verification

All packages are PGP signed by SOT for security.

You can verify each package with the following command:
rpm --checksig 

If you wish to verify the integrity of the downloaded package, run
"md5sum " and compare the output with data given below.


Package Name                             MD5 sum
-------------------------------------------------------------------------
/Desktop/i386/openssl-0.9.6b-15.i386.rpm 6bf53f2b4ca2fad4e255f32b0cace61b
/Desktop/SRPMS/openssl-0.9.6b-15.src.rpm 840e78dbefd926964e439ec389b9a0ca
/Server/i386/openssl-0.9.6b-15.i386.rpm  6bf53f2b4ca2fad4e255f32b0cace61b
/Server/SRPMS/openssl-0.9.6b-15.src.rpm  840e78dbefd926964e439ec389b9a0ca

5. References

http://www.openssl.org/news/secadv_20020730.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0655
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0656
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0657

Copyright(c) 2001, 2002 SOT

---------------------------------------------------------------------
You can view other update advisories for SOT Linux 2002 at:
http://www.sot.com/en/linux/sa/
To unsubscribe, visit your account at https://www.sot.com/
---------------------------------------------------------------------