drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Preisgabe von Informationen in OpenVPN
Name: |
Preisgabe von Informationen in OpenVPN |
|
ID: |
MDVSA-2013:167 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva Enterprise Server 5.0, Mandriva Business Server 1.0 |
|
Datum: |
Mo, 27. Mai 2013, 14:34 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2061
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0153 |
|
Applikationen: |
OpenVPN |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1369656552-2483-1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2013:167 http://www.mandriva.com/en/support/security/ _______________________________________________________________________
Package : openvpn Date : May 27, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 _______________________________________________________________________
Problem Description:
Updated openvpn package fixes security vulnerability: OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function. Plaintext recovery may be possible using a padding oracle attack on the CBC mode cipher implementation of the crypto library, optimistically at a rate of about one character per 3 hours. PolarSSL seems vulnerable to such an attack; the vulnerability of OpenSSL has not been verified or tested (CVE-2013-2061). _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2061 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0153 _______________________________________________________________________
Updated Packages:
Mandriva Enterprise Server 5: c3f9d0b84493a7df95b526bf27684644 mes5/i586/openvpn-2.1-0.rc10.2.4mdvmes5.2.i586.rpm c1808613e341bb1ebcabcebb2ad5fd47 mes5/SRPMS/openvpn-2.1-0.rc10.2.4mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64: ff387b293bcba6c126b14431d1bcb7ab mes5/x86_64/openvpn-2.1-0.rc10.2.4mdvmes5.2.x86_64.rpm c1808613e341bb1ebcabcebb2ad5fd47 mes5/SRPMS/openvpn-2.1-0.rc10.2.4mdvmes5.2.src.rpm
Mandriva Business Server 1/X86_64: 9644de77991bb55ddff9801c7cb8f5a8 mbs1/x86_64/openvpn-2.2.2-6.1.mbs1.x86_64.rpm b4b073c276bd20929db3bcb2b6e80621 mbs1/SRPMS/openvpn-2.2.2-6.1.mbs1.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/en/support/security/advisories/
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux)
iD8DBQFRoyBamqjQ0CJFipgRAvw4AJ90mTSzeb2S0G3oSe3zKG1SIMO/ygCgrfMm 1c8qCHRz/C2Nz7KkfzKqKyo= =Izkl -----END PGP SIGNATURE-----
------------=_1369656552-2483-1 Content-Type: text/plain; charset="UTF-8"; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com _______________________________________________________
------------=_1369656552-2483-1--
|
|
|
|