Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


More on LinuxToday


Slackware Linux Advisory: OpenSSL

Oct 01, 2003, 16:59 (0 Talkback[s])

[slackware-security] OpenSSL security update (SSA:2003-273-01)

Upgraded OpenSSL packages are available for Slackware 8.1, 9.0, 9.1, and -current. These fix problems with ASN.1 parsing which could lead to a denial of service. It is not known whether the problems could lead to the running of malicious code on the server, but it has not been ruled out.

We recommend sites that use OpenSSL upgrade to the fixed packages right away.

Here are the details from the Slackware 9.1 ChangeLog:


Tue Sep 30 16:16:35 PDT 2003
patches/packages/openssl-0.9.7c-i486-1.tgz: Upgraded to OpenSSL 0.9.7c. patches/packages/openssl-solibs-0.9.7c-i486-1.tgz: Upgraded to OpenSSL 0.9.7c.
This update fixes problems with OpenSSL's ASN.1 parsing which could lead to a denial of service. It is not known whether the problems could lead to the running of malicious code on the server, but it has not been ruled out.
For detailed information, see OpenSSL's security advisory:
http://www.openssl.org/news/secadv_20030930.txt
We recommend sites that use OpenSSL upgrade to the fixed packages right away.
(* Security fix *)


WHERE TO FIND THE NEW PACKAGES:

Updated packages for Slackware 8.1:
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssl-0.9.6k-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/openssl-solibs-0.9.6k-i386-1.tgz

Updated packages for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-0.9.7c-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-solibs-0.9.7c-i386-1.tgz

Updated packages for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-0.9.7c-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-solibs-0.9.7c-i486-1.tgz

Updated packages for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-0.9.7c-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-0.9.7c-i486-1.tgz

MD5 SIGNATURES:

Slackware 8.1 packages:
b16847083943c529ff63a07331d1818f openssl-0.9.6k-i386-1.tgz/ a371561b0f2148149abc662d02b17381 openssl-solibs-0.9.6k-i386-1.tgz/

Slackware 9.0 packages:
1a45090e4e432884de48beae5dfae540 openssl-0.9.7c-i386-1.tgz/ 04629d814bd468b0b9e4f7da3df92752 openssl-solibs-0.9.7c-i386-1.tgz/

Slackware 9.1 packages:
49dbc64a43633bedb3ff8e5be93e7c6a openssl-0.9.7c-i486-1.tgz/ 7598ad83ffd12e5b8e34dcf60fb18e1d openssl-solibs-0.9.7c-i486-1.tgz/

Slackware -current packages:
49dbc64a43633bedb3ff8e5be93e7c6a openssl-0.9.7c-i486-1.tgz/ 7598ad83ffd12e5b8e34dcf60fb18e1d openssl-solibs-0.9.7c-i486-1.tgz/

INSTALLATION INSTRUCTIONS:

Upgrade using upgradepkg (as root):
# upgradepkg openssl-0.9.7c-i486-1.tgz/ openssl-solibs-0.9.7c-i486-1.tgz/

+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com