-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2008:107 http://www.mandriva.com/security/ _______________________________________________________________________ Package : openssl Date : May 28, 2008 Affected: 2008.1 _______________________________________________________________________ Problem Description: Testing using the Codenomicon TLS test suite discovered a flaw in the handling of server name extension data in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If OpenSSL has been compiled using the non-default TLS server name extensions, a remote attacker could send a carefully crafted packet to a server application using OpenSSL and cause a crash. (CVE-2008-0891) Testing using the Codenomicon TLS test suite discovered a flaw if the 'Server Key exchange message' is omitted from a TLS handshake in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If a client connects to a malicious server with particular cipher suites, the server could cause the client to crash. (CVE-2008-1672) The updated packages have been patched to fix these flaws. Note that any applications using this library must be restarted for the update to take effect. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0891 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1672 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.1: c89ce51d88565b5e01984d02f9d52be2 2008.1/i586/libopenssl0.9.8-0.9.8g-4.1mdv2008.1.i586.rpm 1e1855ac131d2f1d7fe185a972d6cf7e 2008.1/i586/libopenssl0.9.8-devel-0.9.8g-4.1mdv2008.1.i586.rpm abda43307f35316915bf8fab630b5aa4 2008.1/i586/libopenssl0.9.8-static-devel-0.9.8g-4.1mdv2008.1.i586.rpm ad370f030884f7e81eee21ad8ea14b9f 2008.1/i586/openssl-0.9.8g-4.1mdv2008.1.i586.rpm 0081f3e2bd9e38ffa4c27e87e8d2c8ba 2008.1/SRPMS/openssl-0.9.8g-4.1mdv2008.0.src.rpm Mandriva Linux 2008.1/X86_64: e647498bde13d7baebff21a595a7235f 2008.1/x86_64/lib64openssl0.9.8-0.9.8g-4.1mdv2008.1.x86_64.rpm 1afca1fc4741b583413ba74b42617414 2008.1/x86_64/lib64openssl0.9.8-devel-0.9.8g-4.1mdv2008.1.x86_64.rpm 2a9eb1a4d9785234ab7ea71f74835009 2008.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8g-4.1mdv2008.1.x86_64.rpm d9d185ea96fcfa64b11b5318fbdff0e2 2008.1/x86_64/openssl-0.9.8g-4.1mdv2008.1.x86_64.rpm 0081f3e2bd9e38ffa4c27e87e8d2c8ba 2008.1/SRPMS/openssl-0.9.8g-4.1mdv2008.0.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFIPXOFmqjQ0CJFipgRAvQRAJ0aMdxKc+WzCaar5aXcNPif+VMBAwCggx93 MUhEXWV3Mg6NEX0jj/qg7gg= =1WTI -----END PGP SIGNATURE-----
