Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


Top White Papers

More on LinuxToday


Red Hat Linux Advisories: im, openssl

Mar 06, 2003, 17:28 (0 Talkback[s])

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated im packages fix insecure handling of temporary files
Advisory ID:       RHSA-2003:039-06
Issue date:        2003-02-07
Updated on:        2003-03-06
Product:           Red Hat Linux
Keywords:          im tmp
Cross references:  
Obsoletes:         
CVE Names:         CAN-2002-1395
---------------------------------------------------------------------

1. Topic:

New im packages are available that fix the insecure handling of temporary
files.

2. Relevant releases/architectures:

Red Hat Linux 7.0 - noarch
Red Hat Linux 7.1 - noarch
Red Hat Linux 7.2 - noarch
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386

3. Problem description:

Internet Message (IM) is a series of user interface commands and backend
Perl5 libraries that integrate email and the NetNews user interface. They
are designed to be used from both the Mew mail reader for Emacs and the
command line.

A vulnerability has been discovered by Tatsuya Kinoshita in the way two IM
utilities create temporary files.  By anticipating the names used to
create files and directories stored in /tmp, it may be possible for a
local attacker to corrupt or modify data as another user. 

Red Hat Linux 7, 7.1, and 7.2 included IM packages that are vulnerable to
this issue.  This erratum includes IM version 143 which is not vulnerable
to this issue.

Red Hat Linux 7.3, and 8.0 included Mew (Messaging in the Emacs World) 
packages which included vulnerable versions of IM.  This erratum provide
updated Mew packages including IM version 143 which is not vulnerable to
this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory only contains the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. RPMs required:

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/im-143-0.7x.560.src.rpm

noarch:
ftp://updates.redhat.com/7.0/en/os/noarch/im-143-0.7x.560.noarch.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/im-143-0.7x.560.src.rpm

noarch:
ftp://updates.redhat.com/7.1/en/os/noarch/im-143-0.7x.560.noarch.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/im-143-1.src.rpm

noarch:
ftp://updates.redhat.com/7.2/en/os/noarch/im-143-1.noarch.rpm

Red Hat Linux 7.3:

SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/mew-2.2-5.7x.src.rpm

i386:
ftp://updates.redhat.com/7.3/en/os/i386/mew-2.2-5.7x.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mew-common-2.2-5.7x.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mew-xemacs-2.2-5.7x.i386.rpm

Red Hat Linux 8.0:

SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/mew-2.2-6.src.rpm

i386:
ftp://updates.redhat.com/8.0/en/os/i386/mew-2.2-6.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/mew-common-2.2-6.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/mew-xemacs-2.2-6.i386.rpm



6. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
1339e1a6ccfafb1b92ca84ec211fb042 7.0/en/os/SRPMS/im-143-0.7x.560.src.rpm
02be12509784a2c1724648a10944b94a 7.0/en/os/noarch/im-143-0.7x.560.noarch.rpm
1339e1a6ccfafb1b92ca84ec211fb042 7.1/en/os/SRPMS/im-143-0.7x.560.src.rpm
02be12509784a2c1724648a10944b94a 7.1/en/os/noarch/im-143-0.7x.560.noarch.rpm
603fbef64e77847cab198ef21e95551e 7.2/en/os/SRPMS/im-143-1.src.rpm
86b3731ac5396768cbdfc55d71d75413 7.2/en/os/noarch/im-143-1.noarch.rpm
353574cd613a6acbd23d4b7acd32d8bd 7.3/en/os/SRPMS/mew-2.2-5.7x.src.rpm
826812ce71da4063b01e107557684638 7.3/en/os/i386/mew-2.2-5.7x.i386.rpm
3fe56a69a00556798de56e388f8a8d2c 7.3/en/os/i386/mew-common-2.2-5.7x.i386.rpm
bd7adf05659ef521c7b08ff9c702be54 7.3/en/os/i386/mew-xemacs-2.2-5.7x.i386.rpm
1f0574fe054426099cbae66b06435d8f 8.0/en/os/SRPMS/mew-2.2-6.src.rpm
3c6c2174a0bc0f0a1569af9d36f3c68d 8.0/en/os/i386/mew-2.2-6.i386.rpm
47b9bbd126fdd03298ebabe5a15f7806 8.0/en/os/i386/mew-common-2.2-6.i386.rpm
41c228d865760c2a092fe1916c28d1d9 8.0/en/os/i386/mew-xemacs-2.2-6.i386.rpm


These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    
    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    
    md5sum <filename>


7. References:

http://www.debian.org/security/2002/dsa-202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1395

8. Contact:

The Red Hat security contact is <security@redhat.com>.  More contact
details at http://www.redhat.com/solutions/security/news/contact.html

Copyright 2003 Red Hat, Inc.

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated OpenSSL packages fix timing attack
Advisory ID:       RHSA-2003:062-11
Issue date:        2003-02-19
Updated on:        2003-03-06
Product:           Red Hat Linux
Keywords:          
Cross references:  
Obsoletes:         RHSA-2002:160
CVE Names:         CAN-2003-0078
---------------------------------------------------------------------

1. Topic:

Updated OpenSSL packages are available that fix a potential timing-based
attack.

2. Relevant releases/architectures:

Red Hat Linux 6.2 - i386
Red Hat Linux 7.0 - i386
Red Hat Linux 7.1 - i386
Red Hat Linux 7.2 - i386, i686, ia64
Red Hat Linux 7.3 - i386, i686
Red Hat Linux 8.0 - i386, i686

3. Problem description:

OpenSSL is a commercial-grade, full-featured, and open source toolkit that 
implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols as well as a full-strength general purpose
cryptography library.

In a paper, Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin
Vuagnoux describe and demonstrate a timing-based attack on CBC ciphersuites
in SSL and TLS.  An active attacker may be able to use timing observations
to distinguish between two different error cases: cipher padding errors and
MAC verification errors.  Over multiple connections this can leak
sufficient information to make it possible to retrieve the plaintext of a
common, fixed block.

In order for an attack to be sucessful, an attacker must be able to act as
a man-in-the-middle to intercept and modify multiple connections, which all
involve a common fixed plaintext block (such as a password), and have good
network conditions that allow small changes in timing to be reliably
observed.

These erratum packages contain a patch provided by the OpenSSL group that
corrects this vulnerability.

Because server applications are affected by these vulnerabilities, we
advise users to restart all services that use OpenSSL functionality or
alternatively reboot their systems after installing these updates.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory only contains
the desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. RPMs required:

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/openssl-0.9.5a-30.src.rpm

i386:
ftp://updates.redhat.com/6.2/en/os/i386/openssl-0.9.5a-30.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/openssl-devel-0.9.5a-30.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/openssl-perl-0.9.5a-30.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/openssl-python-0.9.5a-30.i386.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/openssl-0.9.6-14.src.rpm

i386:
ftp://updates.redhat.com/7.0/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/openssl-0.9.6-14.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/openssl-devel-0.9.6-14.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/openssl-perl-0.9.6-14.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/openssl-python-0.9.6-14.i386.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
ftp://updates.redhat.com/7.1/en/os/SRPMS/openssl-0.9.6-14.src.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/openssl-0.9.6-14.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/openssl-devel-0.9.6-14.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/openssl-perl-0.9.6-14.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/openssl-python-0.9.6-14.i386.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/openssl096-0.9.6-13.7.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/openssl-0.9.6b-30.7.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/openssl096-0.9.6-13.7.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/openssl-0.9.6b-30.7.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/openssl-devel-0.9.6b-30.7.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/openssl-perl-0.9.6b-30.7.i386.rpm

i686:
ftp://updates.redhat.com/7.2/en/os/i686/openssl-0.9.6b-30.7.i686.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/openssl095a-0.9.5a-18.7.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/openssl096-0.9.6-13.7.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/openssl-0.9.6b-30.7.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/openssl-devel-0.9.6b-30.7.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/openssl-perl-0.9.6b-30.7.ia64.rpm

Red Hat Linux 7.3:

SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
ftp://updates.redhat.com/7.3/en/os/SRPMS/openssl096-0.9.6-13.7.src.rpm
ftp://updates.redhat.com/7.3/en/os/SRPMS/openssl-0.9.6b-30.7.src.rpm

i386:
ftp://updates.redhat.com/7.3/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/openssl096-0.9.6-13.7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/openssl-0.9.6b-30.7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/openssl-devel-0.9.6b-30.7.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/openssl-perl-0.9.6b-30.7.i386.rpm

i686:
ftp://updates.redhat.com/7.3/en/os/i686/openssl-0.9.6b-30.7.i686.rpm

Red Hat Linux 8.0:

SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/openssl095a-0.9.5a-19.src.rpm
ftp://updates.redhat.com/8.0/en/os/SRPMS/openssl096-0.9.6-14.src.rpm
ftp://updates.redhat.com/8.0/en/os/SRPMS/openssl-0.9.6b-31.src.rpm

i386:
ftp://updates.redhat.com/8.0/en/os/i386/openssl095a-0.9.5a-19.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/openssl096-0.9.6-14.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/openssl-0.9.6b-31.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/openssl-devel-0.9.6b-31.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/openssl-perl-0.9.6b-31.i386.rpm

i686:
ftp://updates.redhat.com/8.0/en/os/i686/openssl-0.9.6b-31.i686.rpm



6. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
43fc50cff822dc459bb38e8c369e8965 6.2/en/os/SRPMS/openssl-0.9.5a-30.src.rpm
89f90fbdbf3731f4cd0af1f362ff10bc 6.2/en/os/i386/openssl-0.9.5a-30.i386.rpm
aeba8db707ac96a25dac61586b547ea5 6.2/en/os/i386/openssl-devel-0.9.5a-30.i386.rpm
8b94e526b689a4a6325031b380ec7b37 6.2/en/os/i386/openssl-perl-0.9.5a-30.i386.rpm
4e9fb9fcea2d4d6c9c9f5d0d500b94e1 6.2/en/os/i386/openssl-python-0.9.5a-30.i386.rpm
b1306cc627ed2eee6583cda7318c5d21 7.0/en/os/SRPMS/openssl-0.9.6-14.src.rpm
4eeca68ad45a889cf99e9888244f811f 7.0/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
eafaadaed7be24dfe9f1335d9de6af19 7.0/en/os/i386/openssl-0.9.6-14.i386.rpm
5da72b7b35a9d8529316bd34810406c8 7.0/en/os/i386/openssl-devel-0.9.6-14.i386.rpm
e2d6359f0569c7da631d72f80fe16735 7.0/en/os/i386/openssl-perl-0.9.6-14.i386.rpm
96088bee90bd4c827731316581ce598e 7.0/en/os/i386/openssl-python-0.9.6-14.i386.rpm
0c8458c5fe99f2dccbd99fc1471e579d 7.0/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
b1306cc627ed2eee6583cda7318c5d21 7.1/en/os/SRPMS/openssl-0.9.6-14.src.rpm
4eeca68ad45a889cf99e9888244f811f 7.1/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
eafaadaed7be24dfe9f1335d9de6af19 7.1/en/os/i386/openssl-0.9.6-14.i386.rpm
5da72b7b35a9d8529316bd34810406c8 7.1/en/os/i386/openssl-devel-0.9.6-14.i386.rpm
e2d6359f0569c7da631d72f80fe16735 7.1/en/os/i386/openssl-perl-0.9.6-14.i386.rpm
96088bee90bd4c827731316581ce598e 7.1/en/os/i386/openssl-python-0.9.6-14.i386.rpm
0c8458c5fe99f2dccbd99fc1471e579d 7.1/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
3ae2cc393a411ce6d4bf02ca2902c3b3 7.2/en/os/SRPMS/openssl-0.9.6b-30.7.src.rpm
4eeca68ad45a889cf99e9888244f811f 7.2/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
f6e69835cf22aaf4ed81182d3b3238f2 7.2/en/os/SRPMS/openssl096-0.9.6-13.7.src.rpm
561ca4b931f7aa1b5e5b187eadc50979 7.2/en/os/i386/openssl-0.9.6b-30.7.i386.rpm
b800915ee28c2ee3e16f0efd3a982cfd 7.2/en/os/i386/openssl-devel-0.9.6b-30.7.i386.rpm
61343012eef3bbe98c0d84a507d42139 7.2/en/os/i386/openssl-perl-0.9.6b-30.7.i386.rpm
0c8458c5fe99f2dccbd99fc1471e579d 7.2/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
f1f521a9af06532b0ca4cbadf191f9f6 7.2/en/os/i386/openssl096-0.9.6-13.7.i386.rpm
90238359f766d40a6fea1ce187378e0f 7.2/en/os/i686/openssl-0.9.6b-30.7.i686.rpm
d04117405d4d98952b45482b540adc48 7.2/en/os/ia64/openssl-0.9.6b-30.7.ia64.rpm
835873daf75483628c41030b2d3bf416 7.2/en/os/ia64/openssl-devel-0.9.6b-30.7.ia64.rpm
4bfc8f05437a13ceb5fbcad25e7a4a50 7.2/en/os/ia64/openssl-perl-0.9.6b-30.7.ia64.rpm
6405dbbcc5bb5bf240b4623456b4d6ab 7.2/en/os/ia64/openssl095a-0.9.5a-18.7.ia64.rpm
cca8bf123ae09e0c73b9a817b441af1b 7.2/en/os/ia64/openssl096-0.9.6-13.7.ia64.rpm
3ae2cc393a411ce6d4bf02ca2902c3b3 7.3/en/os/SRPMS/openssl-0.9.6b-30.7.src.rpm
4eeca68ad45a889cf99e9888244f811f 7.3/en/os/SRPMS/openssl095a-0.9.5a-18.7.src.rpm
f6e69835cf22aaf4ed81182d3b3238f2 7.3/en/os/SRPMS/openssl096-0.9.6-13.7.src.rpm
561ca4b931f7aa1b5e5b187eadc50979 7.3/en/os/i386/openssl-0.9.6b-30.7.i386.rpm
b800915ee28c2ee3e16f0efd3a982cfd 7.3/en/os/i386/openssl-devel-0.9.6b-30.7.i386.rpm
61343012eef3bbe98c0d84a507d42139 7.3/en/os/i386/openssl-perl-0.9.6b-30.7.i386.rpm
0c8458c5fe99f2dccbd99fc1471e579d 7.3/en/os/i386/openssl095a-0.9.5a-18.7.i386.rpm
f1f521a9af06532b0ca4cbadf191f9f6 7.3/en/os/i386/openssl096-0.9.6-13.7.i386.rpm
90238359f766d40a6fea1ce187378e0f 7.3/en/os/i686/openssl-0.9.6b-30.7.i686.rpm
280a5beecb76fe4f7a00a745cbc03737 8.0/en/os/SRPMS/openssl-0.9.6b-31.src.rpm
bd2e48a63222cde53b86b00acf368a1e 8.0/en/os/SRPMS/openssl095a-0.9.5a-19.src.rpm
c9103cd84c301e53c7c79f4e349b43fc 8.0/en/os/SRPMS/openssl096-0.9.6-14.src.rpm
aaffbdfe037fdfc0a3a45cea4e3fe7d9 8.0/en/os/i386/openssl-0.9.6b-31.i386.rpm
0a1a647afb7dea3de6bbac9603f3d45b 8.0/en/os/i386/openssl-devel-0.9.6b-31.i386.rpm
41c0188d93babf72ffa3dc88b42cc3a7 8.0/en/os/i386/openssl-perl-0.9.6b-31.i386.rpm
276c04536cfa314afa3154fb9ee58582 8.0/en/os/i386/openssl095a-0.9.5a-19.i386.rpm
8db8722990b478451e8fcb04aa14da2a 8.0/en/os/i386/openssl096-0.9.6-14.i386.rpm
12f5cab2bde7ac88bbb311aeba04bd9e 8.0/en/os/i686/openssl-0.9.6b-31.i686.rpm


These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    
    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    
    md5sum <filename>


7. References:

http://lasecwww.epfl.ch/pub/lasec/doc/Vau02a.ps
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0078

8. Contact:

The Red Hat security contact is <security@redhat.com>.  More contact
details at http://www.redhat.com/solutions/security/news/contact.html

Copyright 2003 Red Hat, Inc.