drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in OpenSSL
Name: |
Mehrere Probleme in OpenSSL |
|
ID: |
200912-01 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Di, 1. Dezember 2009, 23:17 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1377
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1379
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1387
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 |
|
Applikationen: |
OpenSSL |
|
Originalnachricht |
--Sig_/TW6zsBpAo27ueYQoADrp6_l Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200912-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: OpenSSL: Multiple vulnerabilities Date: December 01, 2009 Bugs: #270305, #280591, #292022 ID: 200912-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
Multiple vulnerabilities in OpenSSL might allow remote attackers to conduct multiple attacks, including the injection of arbitrary data into encrypted byte streams.
Background ==========
OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/openssl < 0.9.8l-r2 >=3D 0.9.8l-r2
Description ===========
Multiple vulnerabilities have been reported in OpenSSL:
* Marsh Ray of PhoneFactor and Martin Rex of SAP independently reported that the TLS protocol does not properly handle session renegotiation requests (CVE-2009-3555).
* The MD2 hash algorithm is no longer considered to be cryptographically strong, as demonstrated by Dan Kaminsky. Certificates using this algorithm are no longer accepted (CVE-2009-2409).
* Daniel Mentz and Robin Seggelmann reported the following vulnerabilities related to DTLS: A use-after-free flaw (CVE-2009-1379) and a NULL pointer dereference (CVE-2009-1387) in the dtls1_retrieve_buffered_fragment() function in src/d1_both.c, multiple memory leaks in the dtls1_process_out_of_seq_message() function in src/d1_both.c (CVE-2009-1378), and a processing error related to a large amount of DTLS records with a future epoch in the dtls1_buffer_record() function in ssl/d1_pkt.c (CVE-2009-1377).
Impact ======
A remote unauthenticated attacker, acting as a Man in the Middle, could inject arbitrary plain text into a TLS session, possibly leading to the ability to send requests as if authenticated as the victim. A remote attacker could furthermore send specially crafted DTLS packages to a service using OpenSSL for DTLS support, possibly resulting in a Denial of Service. Also, a remote attacker might be able to create rouge certificates, facilitated by a MD2 collision. NOTE: The amount of computation needed for this attack is still very large.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
All OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=3Ddev-libs/openssl-0.9.8l-r2"
References ==========
[ 1 ] CVE-2009-1377 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2009-1377 [ 2 ] CVE-2009-1378 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2009-1378 [ 3 ] CVE-2009-1379 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2009-1379 [ 4 ] CVE-2009-1387 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2009-1387 [ 5 ] CVE-2009-2409 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2009-2409 [ 6 ] CVE-2009-3555 http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCVE-2009-3555
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200912-01.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.
License =======
Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--Sig_/TW6zsBpAo27ueYQoADrp6_l Content-Type: application/pgp-signature; name=signature.asc Content-Disposition: attachment; filename=signature.asc
-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.13 (GNU/Linux)
iEYEARECAAYFAksVi3MACgkQk+oqhfPAZGlsKwCfab1/5kfL8YIuzmQ4qH1HK3uP CbsAnRdySxwH/NmBYX4LI2b8IrK19Kjq =6IEr -----END PGP SIGNATURE-----
--Sig_/TW6zsBpAo27ueYQoADrp6_l--
|
|
|
|