what you don't know can hurt you

Mandriva Linux Security Advisory 2012-038

Mandriva Linux Security Advisory 2012-038
Posted Mar 26, 2012
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2012-038 - The implementation of Cryptographic Message Syntax and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack adaptive chosen ciphertext attack. The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service via a crafted S/MIME message, a different vulnerability than CVE-2006-7250. The updated packages have been patched to correct these issues.

tags | advisory, remote, denial of service, crypto
systems | linux, mandriva
advisories | CVE-2012-0884, CVE-2012-1165
MD5 | f4a72b486a3e05769f6e164ff30c6861

Mandriva Linux Security Advisory 2012-038

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2012:038
http://www.mandriva.com/security/
_______________________________________________________________________

Package : openssl
Date : March 26, 2012
Affected: 2010.1, 2011., Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in openssl:

The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in
OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict
certain oracle behavior, which makes it easier for context-dependent
attackers to decrypt data via a Million Message Attack (MMA) adaptive
chosen ciphertext attack (CVE-2012-0884).

The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before
0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial
of service (NULL pointer dereference and application crash) via a
crafted S/MIME message, a different vulnerability than CVE-2006-7250
(CVE-2012-1165).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1165
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.1:
820b204b86b1f140bf8526725ee29650 2010.1/i586/libopenssl0.9.8-0.9.8u-0.1mdv2010.2.i586.rpm
f19cb6b757e2502ba930c139ce6cd3c4 2010.1/i586/libopenssl1.0.0-1.0.0a-1.11mdv2010.2.i586.rpm
a57c57a8ebfb75f2da2ce416218655a9 2010.1/i586/libopenssl1.0.0-devel-1.0.0a-1.11mdv2010.2.i586.rpm
d5807ee096478bcca0d08f2145535f78 2010.1/i586/libopenssl1.0.0-static-devel-1.0.0a-1.11mdv2010.2.i586.rpm
cacdcfe367accab7ee4ce75eefd1d28d 2010.1/i586/libopenssl-engines1.0.0-1.0.0a-1.11mdv2010.2.i586.rpm
8a3b57e03df92a2d421672a6495f34a0 2010.1/i586/openssl-1.0.0a-1.11mdv2010.2.i586.rpm
6be06368a541e654742693c6eb705fb1 2010.1/SRPMS/openssl0.9.8-0.9.8u-0.1mdv2010.2.src.rpm
2619947049700ab84d6cad214a0131f3 2010.1/SRPMS/openssl-1.0.0a-1.11mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
dfb5f411e236cc9b4b3f2e005d5f0e2e 2010.1/x86_64/lib64openssl0.9.8-0.9.8u-0.1mdv2010.2.x86_64.rpm
7ee654320d85d3f3aa0bbd94bc42453b 2010.1/x86_64/lib64openssl1.0.0-1.0.0a-1.11mdv2010.2.x86_64.rpm
1d00d58ab6be34fd3542340300038950 2010.1/x86_64/lib64openssl1.0.0-devel-1.0.0a-1.11mdv2010.2.x86_64.rpm
6c7ca81d116a60d500ffddc2f3c7fb57 2010.1/x86_64/lib64openssl1.0.0-static-devel-1.0.0a-1.11mdv2010.2.x86_64.rpm
bcdac0e2468a6e06f4078f05fdafd392 2010.1/x86_64/lib64openssl-engines1.0.0-1.0.0a-1.11mdv2010.2.x86_64.rpm
836de45400c21f24fa5b21b7c706eb98 2010.1/x86_64/openssl-1.0.0a-1.11mdv2010.2.x86_64.rpm
6be06368a541e654742693c6eb705fb1 2010.1/SRPMS/openssl0.9.8-0.9.8u-0.1mdv2010.2.src.rpm
2619947049700ab84d6cad214a0131f3 2010.1/SRPMS/openssl-1.0.0a-1.11mdv2010.2.src.rpm

Mandriva Linux 2011:
1960675e9fe0ae8da138ecba0bf9e6b4 2011/i586/libopenssl1.0.0-1.0.0d-2.4-mdv2011.0.i586.rpm
de70876cfc6918c35b89cae61ccb2788 2011/i586/libopenssl-devel-1.0.0d-2.4-mdv2011.0.i586.rpm
68696a78df495d3245034e776ececf24 2011/i586/libopenssl-engines1.0.0-1.0.0d-2.4-mdv2011.0.i586.rpm
fba71506079447ff67b7e52c15004221 2011/i586/libopenssl-static-devel-1.0.0d-2.4-mdv2011.0.i586.rpm
f8992d4ee7b2c0d979a314593c590e8b 2011/i586/openssl-1.0.0d-2.4-mdv2011.0.i586.rpm
34324e854461c4102c4db333d3f575ba 2011/SRPMS/openssl-1.0.0d-2.4.src.rpm

Mandriva Linux 2011/X86_64:
89645faf8d71d72afa62c2be5d21a55b 2011/x86_64/lib64openssl1.0.0-1.0.0d-2.4-mdv2011.0.x86_64.rpm
2f3e7dc11f36f7f10bc26669ea0d359a 2011/x86_64/lib64openssl-devel-1.0.0d-2.4-mdv2011.0.x86_64.rpm
aecefb41191efa106dc11cfdff6e5dbc 2011/x86_64/lib64openssl-engines1.0.0-1.0.0d-2.4-mdv2011.0.x86_64.rpm
ec65b7b472890dd336239605846a3a56 2011/x86_64/lib64openssl-static-devel-1.0.0d-2.4-mdv2011.0.x86_64.rpm
db15536fedf4e8e8e00f1877f2939f6d 2011/x86_64/openssl-1.0.0d-2.4-mdv2011.0.x86_64.rpm
34324e854461c4102c4db333d3f575ba 2011/SRPMS/openssl-1.0.0d-2.4.src.rpm

Mandriva Enterprise Server 5:
4bd8479bc2fad30096d37d498240c507 mes5/i586/libopenssl0.9.8-0.9.8h-3.14mdvmes5.2.i586.rpm
33cf65c119e4d84738619a84e598aba2 mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.14mdvmes5.2.i586.rpm
ca767a0cbeb99230946ebb35191b9df2 mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.14mdvmes5.2.i586.rpm
9f3bba03e5aff24ecd26bae11c99af91 mes5/i586/openssl-0.9.8h-3.14mdvmes5.2.i586.rpm
65c9f262dd6b4d66069649ea1e596b4b mes5/SRPMS/openssl-0.9.8h-3.14mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
e0b68754036f1114ed20cf8199d7625d mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.14mdvmes5.2.x86_64.rpm
ba2d5446973c7aecbe93ac7455cb7a7b mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.14mdvmes5.2.x86_64.rpm
a16b1e15a2164eadf4d052f7f29080fd mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.14mdvmes5.2.x86_64.rpm
71e785c5e2bda4cfc189ae8adff9cd54 mes5/x86_64/openssl-0.9.8h-3.14mdvmes5.2.x86_64.rpm
65c9f262dd6b4d66069649ea1e596b4b mes5/SRPMS/openssl-0.9.8h-3.14mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFPcG6AmqjQ0CJFipgRAgdKAKCe5y81j9lidhC+Mjg3Q1XMcAyosQCfe2zE
JfKo2hU2JCc2U3RLbBgqRek=
=vipz
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    11 Files
  • 21
    May 21st
    21 Files
  • 22
    May 22nd
    20 Files
  • 23
    May 23rd
    36 Files
  • 24
    May 24th
    2 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close