This update adds support for RFC5746 TLS renegotiations to address vulnerabilities tracked as (CVE-2009-3555). It also fixes a mishandling of OOM conditions in bn_wexpand. (CVE-2009-3245)

Installation notes

This update is provided as RPM packages that can easily be installed onto a running system by using this command :

rpm -Fvh libopenssl-devel.rpm libopenssl0_9_8.rpm libopenssl0_9_8-32bit.rpm libopenssl0_9_8-x86.rpm openssl.rpm openssl-debuginfo.rpm openssl-debugsource.rpm openssl-doc.rpm

A ciphersuite downgrade flaw was found in the OpenSSL SSL/TLS server code. A remote attacker could possibly use this flaw to change the ciphersuite associated with a cached session stored on the server, if the server enabled the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option, possibly forcing the client to use a weaker ciphersuite after resuming the session. (CVE-2010-4180, CVE-2008-7270)

Note: With this update, setting the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option has no effect and this bug workaround can no longer be enabled.

It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function. An attacker able to trigger a memory allocation failure in that function could possibly crash an application using the OpenSSL library and its UBSEC hardware engine support. (CVE-2009-3245 - SL4 Only)

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix for CVE-2014-0224 - SSL/TLS MITM vulnerability

  - replace expired GlobalSign Root CA certificate in     ca-bundle.crt

  - fix for CVE-2013-0169 - SSL/TLS CBC timing attack     (#907589)

  - fix for CVE-2013-0166 - DoS in OCSP signatures checking     (#908052)

  - enable compression only if explicitly asked for or     OPENSSL_DEFAULT_ZLIB environment variable is set (fixes     CVE-2012-4929 #857051)

  - use __secure_getenv everywhere instead of getenv     (#839735)

  - fix for CVE-2012-2333 - improper checking for record     length in DTLS (#820686)

  - fix for CVE-2012-2110 - memory corruption in     asn1_d2i_read_bio (#814185)

  - fix problem with the SGC restart patch that might     terminate handshake incorrectly

  - fix for CVE-2012-0884 - MMA weakness in CMS and PKCS#7     code (#802725)

  - fix for CVE-2012-1165 - NULL read dereference on bad     MIME headers (#802489)

  - fix for CVE-2011-4108 & CVE-2012-0050 - DTLS plaintext     recovery vulnerability and additional DTLS fixes     (#771770)

  - fix for CVE-2011-4109 - double free in policy checks     (#771771)

  - fix for CVE-2011-4576 - uninitialized SSL 3.0 padding     (#771775)

  - fix for CVE-2011-4619 - SGC restart DoS attack (#771780)

  - add known answer test for SHA2 algorithms (#740866)

  - make default private key length in certificate Makefile     2048 bits (can be changed with PRIVATE_KEY_BITS setting)     (#745410)

  - fix incorrect return value in parse_yesno (#726593)

  - added DigiCert CA certificates to ca-bundle (#735819)

  - added a new section about error states to README.FIPS     (#628976)

  - add missing DH_check_pub_key call when DH key is     computed (#698175)

  - presort list of ciphers available in SSL (#688901)

  - accept connection in s_server even if getaddrinfo fails     (#561260)

  - point to openssl dgst for list of supported digests     (#608639)

  - fix handling of future TLS versions (#599112)

  - added VeriSign Class 3 Public Primary Certification     Authority - G5 and StartCom Certification Authority     certs to ca-bundle (#675671, #617856)

  - upstream fixes for the CHIL engine (#622003, #671484)

  - add SHA-2 hashes in SSL_library_init (#676384)

  - fix CVE-2010-4180 - completely disable code for     SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (#659462)

  - fix CVE-2009-3245 - add missing bn_wexpand return checks     (#570924)

  - fix CVE-2010-0433 - do not pass NULL princ to     krb5_kt_get_entry which in the RHEL-5 and newer versions     will crash in such case (#569774)

  - fix CVE-2009-3555 - support the safe renegotiation     extension and do not allow legacy renegotiation on the     server by default (#533125)

  - fix CVE-2009-2409 - drop MD2 algorithm from EVP tables     (#510197)

  - fix CVE-2009-4355 - do not leak memory when     CRYPTO_cleanup_all_ex_data is called prematurely by     application (#546707)

This update fixes multiple bugs and security issues. It especially adds support for RFC5746.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

a. Service Console update for NSS_db

   The service console package NSS_db is updated to version    nss_db-2.2-35.4.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0826 to this issue.

b. Service Console update for OpenLDAP

   The service console package OpenLDAP updated to version    2.3.43-12.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-3767 to this issue.

c. Service Console update for cURL

   The service console packages for cURL updated to version    7.15.5-9.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to this issue.

d. Service Console update for sudo

   The service console package sudo updated to version 1.7.2p1-7.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-1646 to this issue.

e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR

   Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2    and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8,    and NSS to version 3.12.6-1.3235.vmw and NSPR to version    4.8.4-1.3235.vmw. These four updates are bundled together due to    their mutual dependencies.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245    and CVE-2010-0433 to the issues addressed in this update.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssl098e packages installed that are affected by multiple vulnerabilities:

  - OpenSSL 0.9.7 before 0.9.7l and 0.9.8 before 0.9.8d     allows remote attackers to cause a denial of service     (infinite loop and memory consumption) via malformed     ASN.1 structures that trigger an improperly handled     error condition. (CVE-2006-2937)

  - OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and     earlier versions allows attackers to cause a denial of     service (CPU consumption) via parasitic public keys with     large (1) public exponent or (2) public modulus     values in X.509 certificates that require extra time to     process when using RSA signature verification.
    (CVE-2006-2940)

  - Buffer overflow in the SSL_get_shared_ciphers function     in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and     earlier versions has unspecified impact and remote     attack vectors involving a long list of ciphers.
    (CVE-2006-3738)

  - OpenSSL before 0.9.7, 0.9.7 before 0.9.7k, and 0.9.8     before 0.9.8c, when using an RSA key with exponent 3,     removes PKCS-1 padding before generating a hash, which     allows remote attackers to forge a PKCS #1 v1.5     signature that is signed by that RSA key and prevents     OpenSSL from correctly verifying X.509 and other     certificates that use PKCS #1. (CVE-2006-4339)

  - The get_server_hello function in the SSLv2 client code     in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and     earlier versions allows remote servers to cause a denial     of service (client crash) via unknown vectors that     trigger a null pointer dereference. (CVE-2006-4343)

  - The BN_from_montgomery function in crypto/bn/bn_mont.c     in OpenSSL 0.9.8e and earlier does not properly perform     Montgomery multiplication, which might allow local users     to conduct a side-channel attack and retrieve RSA     private keys. (CVE-2007-3108)

  - Off-by-one error in the DTLS implementation in OpenSSL     0.9.8 before 0.9.8f allows remote attackers to execute     arbitrary code via unspecified vectors. (CVE-2007-4995)

  - Off-by-one error in the SSL_get_shared_ciphers function     in OpenSSL 0.9.7 up to 0.9.7l, and 0.9.8 up to 0.9.8f,     might allow remote attackers to execute arbitrary code     via a crafted packet that triggers a one-byte buffer     underflow. NOTE: this issue was introduced as a result     of a fix for CVE-2006-3738. As of 20071012, it is     unknown whether code execution is possible.
    (CVE-2007-5135)

  - OpenSSL 0.9.8i and earlier does not properly check the     return value from the EVP_VerifyFinal function, which     allows remote attackers to bypass validation of the     certificate chain via a malformed SSL/TLS signature for     DSA and ECDSA keys. (CVE-2008-5077)

  - The ASN1_STRING_print_ex function in OpenSSL before     0.9.8k allows remote attackers to cause a denial of     service (invalid memory access and application crash)     via vectors that trigger printing of a (1) BMPString or     (2) UniversalString with an invalid encoded length.
    (CVE-2009-0590)

  - The dtls1_buffer_record function in ssl/d1_pkt.c in     OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote     attackers to cause a denial of service (memory     consumption) via a large series of future epoch DTLS     records that are buffered in a queue, aka DTLS record     buffer limitation bug. (CVE-2009-1377)

  - Multiple memory leaks in the     dtls1_process_out_of_seq_message function in     ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8     versions allow remote attackers to cause a denial of     service (memory consumption) via DTLS records that (1)     are duplicates or (2) have sequence numbers much greater     than current sequence numbers, aka DTLS fragment     handling memory leak. (CVE-2009-1378)

  - Use-after-free vulnerability in the     dtls1_retrieve_buffered_fragment function in     ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote     attackers to cause a denial of service (openssl s_client     crash) and possibly have unspecified other impact via a     DTLS packet, as demonstrated by a packet from a server     that uses a crafted server certificate. (CVE-2009-1379)

  - ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote     attackers to cause a denial of service (NULL pointer     dereference and daemon crash) via a DTLS     ChangeCipherSpec packet that occurs before ClientHello.
    (CVE-2009-1386)

  - The dtls1_retrieve_buffered_fragment function in     ssl/d1_both.c in OpenSSL before 1.0.0 Beta 2 allows     remote attackers to cause a denial of service (NULL     pointer dereference and daemon crash) via an out-of-     sequence DTLS handshake message, related to a fragment     bug. (CVE-2009-1387)

  - The Network Security Services (NSS) library before     3.12.3, as used in Firefox; GnuTLS before 2.6.4 and     2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products     support MD2 with X.509 certificates, which might allow     remote attackers to spoof certificates by using MD2     design flaws to generate a hash collision in less than     brute-force time. NOTE: the scope of this issue is     currently limited because the amount of computation     required is still large. (CVE-2009-2409)

  - OpenSSL before 0.9.8m does not check for a NULL return     value from bn_wexpand function calls in (1)     crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3)     crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which     has unspecified impact and context-dependent attack     vectors. (CVE-2009-3245)

  - The TLS protocol, and the SSL protocol 3.0 and possibly     earlier, as used in Microsoft Internet Information     Services (IIS) 7.0, mod_ssl in the Apache HTTP Server     2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5     and earlier, Mozilla Network Security Services (NSS)     3.12.4 and earlier, multiple Cisco products, and other     products, does not properly associate renegotiation     handshakes with an existing connection, which allows     man-in-the-middle attackers to insert data into HTTPS     sessions, and possibly other types of sessions protected     by TLS or SSL, by sending an unauthenticated request     that is processed retroactively by a server in a post-     renegotiation context, related to a plaintext     injection attack, aka the Project Mogul issue.
    (CVE-2009-3555)

  - Memory leak in the zlib_stateful_finish function in     crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and     1.0.0 Beta through Beta 4 allows remote attackers to     cause a denial of service (memory consumption) via     vectors that trigger incorrect calls to the     CRYPTO_cleanup_all_ex_data function, as demonstrated by     use of SSLv3 and PHP with the Apache HTTP Server, a     related issue to CVE-2008-1678. (CVE-2009-4355)

  - The kssl_keytab_is_available function in ssl/kssl.c in     OpenSSL before 0.9.8n, when Kerberos is enabled but     Kerberos configuration files cannot be opened, does not     check a certain return value, which allows remote     attackers to cause a denial of service (NULL pointer     dereference and daemon crash) via SSL cipher     negotiation, as demonstrated by a chroot installation of     Dovecot or stunnel without Kerberos configuration files     inside the chroot. (CVE-2010-0433)

  - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c     in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1     before 1.0.1a does not properly interpret integer data,     which allows remote attackers to conduct buffer overflow     attacks, and cause a denial of service (memory     corruption) or possibly have unspecified other impact,     via crafted DER data, as demonstrated by an X.509     certificate or an RSA public key. (CVE-2012-2110)

  - The TLS protocol 1.2 and earlier, as used in Mozilla     Firefox, Google Chrome, Qt, and other products, can     encrypt compressed data without properly obfuscating the     length of the unencrypted data, which allows man-in-the-     middle attackers to obtain plaintext HTTP headers by     observing length differences during a series of guesses     in which a string in an HTTP request potentially matches     an unknown string in an HTTP header, aka a CRIME     attack. (CVE-2012-4929)

  - OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1     before 1.0.1d does not properly perform signature     verification for OCSP responses, which allows remote     OCSP servers to cause a denial of service (NULL pointer     dereference and application crash) via an invalid key.
    (CVE-2013-0166)

  - The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0     and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and     other products, do not properly consider timing side-     channel attacks on a MAC check requirement during the     processing of malformed CBC padding, which allows remote     attackers to conduct distinguishing attacks and     plaintext-recovery attacks via statistical analysis of     timing data for crafted packets, aka the Lucky     Thirteen issue. (CVE-2013-0169)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
50937	SuSE 11 Security Update : OpenSSL (SAT Patch Number 2214)	Nessus	SuSE Local Security Checks	2010/12/2	2021/1/14	critical
60921	Scientific Linux Security Update : openssl on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical
79531	OracleVM 2.2 : openssl (OVMSA-2014-0007)	Nessus	OracleVM Local Security Checks	2014/11/26	2022/12/5	high
47509	Fedora 12 : openssl-1.0.0-4.fc12 (2010-8742)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	critical
49703	VMSA-2010-0015 : VMware ESX third-party updates for Service Console	Nessus	VMware ESX Local Security Checks	2010/10/4	2021/1/6	critical
127177	NewStart CGSL CORE 5.04 / MAIN 5.04 : openssl098e Multiple Vulnerabilities (NS-SA-2019-0020)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/12/6	critical

检测

插件搜索

critical

critical

high

critical

critical

critical