-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:221 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libneon0.27 Date : August 24, 2009 Affected: 2008.1, 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been found and corrected in libneon0.27: neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564 (CVE-2009-2473). neon before 0.28.6, when OpenSSL is used, does not properly handle a '\0' (NUL) character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2009-2474). This update provides a solution to these vulnerabilities. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2473 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2474 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.1: 26729257d5b2255a8a6242cfe6931dc9 2008.1/i586/libneon0.27-0.28.3-0.2mdv2008.1.i586.rpm 992af0611f69a2e4043f29faf50de608 2008.1/i586/libneon0.27-devel-0.28.3-0.2mdv2008.1.i586.rpm 71e83652b0aa875f404ecf0df9409184 2008.1/i586/libneon0.27-static-devel-0.28.3-0.2mdv2008.1.i586.rpm a4b59dd8d54e66de85f70186c7726269 2008.1/SRPMS/libneon0.27-0.28.3-0.2mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: 56eb9b74f3e2202ac683377a16799c70 2008.1/x86_64/lib64neon0.27-0.28.3-0.2mdv2008.1.x86_64.rpm f688d9a1285f19e7b80997b52a147a60 2008.1/x86_64/lib64neon0.27-devel-0.28.3-0.2mdv2008.1.x86_64.rpm 08f5058e8dc35470e8cdc8cf9cb16381 2008.1/x86_64/lib64neon0.27-static-devel-0.28.3-0.2mdv2008.1.x86_64.rpm a4b59dd8d54e66de85f70186c7726269 2008.1/SRPMS/libneon0.27-0.28.3-0.2mdv2008.1.src.rpm Mandriva Linux 2009.0: 9bf34661a2420bd2402cafc4565a2587 2009.0/i586/libneon0.27-0.28.3-1.1mdv2009.0.i586.rpm f6ed581464940115491ec68cacafe859 2009.0/i586/libneon0.27-devel-0.28.3-1.1mdv2009.0.i586.rpm db2dc25faa186ceb3394af63a9e2d0e6 2009.0/i586/libneon0.27-static-devel-0.28.3-1.1mdv2009.0.i586.rpm 14cbfad698a74067a74199807e8c9282 2009.0/SRPMS/libneon0.27-0.28.3-1.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 3a86cf10f1df3feaea91ae64e28f3e8d 2009.0/x86_64/lib64neon0.27-0.28.3-1.1mdv2009.0.x86_64.rpm 872195ee41e00405d03ab18010bd15d9 2009.0/x86_64/lib64neon0.27-devel-0.28.3-1.1mdv2009.0.x86_64.rpm f841222c663bc8506e6e0e87a165c6b7 2009.0/x86_64/lib64neon0.27-static-devel-0.28.3-1.1mdv2009.0.x86_64.rpm 14cbfad698a74067a74199807e8c9282 2009.0/SRPMS/libneon0.27-0.28.3-1.1mdv2009.0.src.rpm Mandriva Linux 2009.1: 14c6caacb5e2b3f9e0a2e7b7924ba1e3 2009.1/i586/libneon0.27-0.28.3-2.1mdv2009.1.i586.rpm 242e3182440acc212408d03d27ba9a08 2009.1/i586/libneon0.27-devel-0.28.3-2.1mdv2009.1.i586.rpm 71701b0c1b6931979cb6eabe377522aa 2009.1/i586/libneon0.27-static-devel-0.28.3-2.1mdv2009.1.i586.rpm 58bd3f3f6ac9178d9e4903fa88fd5862 2009.1/SRPMS/libneon0.27-0.28.3-2.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 5ac6a8cefa50849e32957b821ec1ef8c 2009.1/x86_64/lib64neon0.27-0.28.3-2.1mdv2009.1.x86_64.rpm 5b801b45bf9d73a59b7eb0a4b350431f 2009.1/x86_64/lib64neon0.27-devel-0.28.3-2.1mdv2009.1.x86_64.rpm 72e5bce2285b22ccd6b6f68c8c47bff8 2009.1/x86_64/lib64neon0.27-static-devel-0.28.3-2.1mdv2009.1.x86_64.rpm 58bd3f3f6ac9178d9e4903fa88fd5862 2009.1/SRPMS/libneon0.27-0.28.3-2.1mdv2009.1.src.rpm Corporate 4.0: 6c92c285d835d3d283c820bbe14fa013 corporate/4.0/i586/libneon0.27-0.28.3-0.2.20060mlcs4.i586.rpm ae72e53a686010d7b31e56bee90000e5 corporate/4.0/i586/libneon0.27-devel-0.28.3-0.2.20060mlcs4.i586.rpm 1814371725d85bb607af694a074fc816 corporate/4.0/i586/libneon0.27-static-devel-0.28.3-0.2.20060mlcs4.i586.rpm 617b5c9c0bf440531b571e34409023b3 corporate/4.0/SRPMS/libneon0.27-0.28.3-0.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 9db63260cab1c01d8f6e3882f719a8a6 corporate/4.0/x86_64/lib64neon0.27-0.28.3-0.2.20060mlcs4.x86_64.rpm 526df150c547d98fdeeda8241774bcbf corporate/4.0/x86_64/lib64neon0.27-devel-0.28.3-0.2.20060mlcs4.x86_64.rpm 02fa7448bb3a59c6f0947a2e96983813 corporate/4.0/x86_64/lib64neon0.27-static-devel-0.28.3-0.2.20060mlcs4.x86_64.rpm 617b5c9c0bf440531b571e34409023b3 corporate/4.0/SRPMS/libneon0.27-0.28.3-0.2.20060mlcs4.src.rpm Mandriva Enterprise Server 5: a2209a398a7f98673c5bd459dfa1fd58 mes5/i586/libneon0.27-0.28.3-1.1mdvmes5.i586.rpm 18631025bb665c21dcbd4ef75986dc2f mes5/i586/libneon0.27-devel-0.28.3-1.1mdvmes5.i586.rpm b216b56ea349e57db0bd1a06791c1192 mes5/i586/libneon0.27-static-devel-0.28.3-1.1mdvmes5.i586.rpm 2cd59a4c7297629446c6c0779363d6fd mes5/SRPMS/libneon0.27-0.28.3-1.1mdvmes5.src.rpm Mandriva Enterprise Server 5/X86_64: ee892ef74cca60e827899a0d9e06c8cd mes5/x86_64/lib64neon0.27-0.28.3-1.1mdvmes5.x86_64.rpm db0c1a9ab2315bf05dc35382349d4534 mes5/x86_64/lib64neon0.27-devel-0.28.3-1.1mdvmes5.x86_64.rpm 0c131d6264ef181e0b3870c8eb438b36 mes5/x86_64/lib64neon0.27-static-devel-0.28.3-1.1mdvmes5.x86_64.rpm 2cd59a4c7297629446c6c0779363d6fd mes5/SRPMS/libneon0.27-0.28.3-1.1mdvmes5.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKkvLkmqjQ0CJFipgRAq6qAJ9cjtiGVrF46gPqCQlUYpyiTrM/uwCgm9Wp 0gkprOAZM9dbBhPRDNeWeEs= =E/sr -----END PGP SIGNATURE-----
