-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2013:167 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : openvpn Date : May 27, 2013 Affected: Business Server 1.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Updated openvpn package fixes security vulnerability: OpenVPN 2.3.0 and earlier running in UDP mode are subject to chosen ciphertext injection due to a non-constant-time HMAC comparison function. Plaintext recovery may be possible using a padding oracle attack on the CBC mode cipher implementation of the crypto library, optimistically at a rate of about one character per 3 hours. PolarSSL seems vulnerable to such an attack; the vulnerability of OpenSSL has not been verified or tested (CVE-2013-2061). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2061 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0153 _______________________________________________________________________ Updated Packages: Mandriva Enterprise Server 5: c3f9d0b84493a7df95b526bf27684644 mes5/i586/openvpn-2.1-0.rc10.2.4mdvmes5.2.i586.rpm c1808613e341bb1ebcabcebb2ad5fd47 mes5/SRPMS/openvpn-2.1-0.rc10.2.4mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: ff387b293bcba6c126b14431d1bcb7ab mes5/x86_64/openvpn-2.1-0.rc10.2.4mdvmes5.2.x86_64.rpm c1808613e341bb1ebcabcebb2ad5fd47 mes5/SRPMS/openvpn-2.1-0.rc10.2.4mdvmes5.2.src.rpm Mandriva Business Server 1/X86_64: 9644de77991bb55ddff9801c7cb8f5a8 mbs1/x86_64/openvpn-2.2.2-6.1.mbs1.x86_64.rpm b4b073c276bd20929db3bcb2b6e80621 mbs1/SRPMS/openvpn-2.2.2-6.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFRoyBamqjQ0CJFipgRAvw4AJ90mTSzeb2S0G3oSe3zKG1SIMO/ygCgrfMm 1c8qCHRz/C2Nz7KkfzKqKyo= =Izkl -----END PGP SIGNATURE-----
