rPath Security Advisory: 2011-0013-1
Published: 2011-04-11
Products:
rPath Appliance Platform Linux Service 1
rPath Appliance Platform Linux Service 2
rPath Linux 1
rPath Linux 2
Rating: Major
Exposure Level Classification:
Remote System User Deterministic Denial of Service
Updated Versions:
openssl=conary.rpath.com@rpl:1/0.9.7f-10.20-1
openssl=conary.rpath.com@rpl:2/0.9.8g-7.7-1
openssl-scripts=conary.rpath.com@rpl:1/0.9.7f-10.13-1
openssl-scripts=conary.rpath.com@rpl:2/0.9.8g-7.7-1
rPath Issue Tracking System:
https://issues.rpath.com/browse/RPL-3262
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180
Description:
Previous versions of openssl, when
SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG was enabled, were
vulnerable to a ciphersuite downgrade attack, which could lead to
a remote attacker to potentially forcing a client to use a weaker
cipher.
Additinally, previous versions of openssl did not check for a NULL
return value from the bn_wexpand function, which could lead to a
remote denial of service.
http://wiki.rpath.com/Advisories:rPSA-2011-0013
Copyright 2011 rPath, Inc.
This file is distributed under the terms of the MIT License.
A copy is available at http://www.rpath.com/permanent/mit-license.html
