exploit the possibilities

Mandriva Linux Security Advisory 2013-050

Mandriva Linux Security Advisory 2013-050
Posted Apr 7, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-050 - Google reported to Mozilla that TURKTRUST, a certificate authority in Mozillas root program, had mis-issued two intermediate certificates to customers. The issue was not specific to Firefox but there was evidence that one of the certificates was used for man-in-the-middle traffic management of domain names that the customer did not legitimately own or control. This issue was resolved by revoking the trust for these specific mis-issued certificates. The rootcerts package has been upgraded to address this flaw and the Mozilla NSS package has been rebuilt to pickup the changes. The TLS implementation in Mozilla Network Security Services does not properly consider timing side-channel attacks on a non-compliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. The NSPR package has been upgraded to the 4.9.5 version due to dependencies of newer NSS. The NSS package has been upgraded to the 3.14.3 version which is not vulnerable to this issue. The sqlite3 update addresses a crash when using svn commit after export MALLOC_CHECK_=3.

tags | advisory, remote, root
systems | linux, mandriva
advisories | CVE-2013-0743, CVE-2013-1620
MD5 | 1fbe42a52c72ffd05217947d1cbebd22

Mandriva Linux Security Advisory 2013-050

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:050
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : nss
Date : April 5, 2013
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Google reported to Mozilla that TURKTRUST, a certificate authority in
Mozillas root program, had mis-issued two intermediate certificates
to customers. The issue was not specific to Firefox but there was
evidence that one of the certificates was used for man-in-the-middle
(MITM) traffic management of domain names that the customer did not
legitimately own or control. This issue was resolved by revoking the
trust for these specific mis-issued certificates (CVE-2013-0743).

The rootcerts package has been upgraded to address this flaw and the
Mozilla NSS package has been rebuilt to pickup the changes.

The TLS implementation in Mozilla Network Security Services (NSS) does
not properly consider timing side-channel attacks on a noncompliant
MAC check operation during the processing of malformed CBC padding,
which allows remote attackers to conduct distinguishing attacks and
plaintext-recovery attacks via statistical analysis of timing data
for crafted packets, a related issue to CVE-2013-0169 (CVE-2013-1620).

The NSPR package has been upgraded to the 4.9.5 version due to
dependecies of newer NSS.

The NSS package has been upgraded to the 3.14.3 version which is not
vulnerable to this issue.

The sqlite3 update addresses a crash when using svn commit after
export MALLOC_CHECK_=3.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0743
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1620
http://www.mozilla.org/security/announce/2013/mfsa2013-20.html
https://wiki.mageia.org/en/Support/Advisories/MGAA-2012-0234
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
3ac700b08583902518038ae60684023a mbs1/x86_64/lemon-3.7.14.1-1.mbs1.x86_64.rpm
9c39fbacc1cc36382697e7509a07a8c1 mbs1/x86_64/lib64nspr4-4.9.5-1.mbs1.x86_64.rpm
8e5ff19af56d79f20fe606dcdbfb5153 mbs1/x86_64/lib64nspr-devel-4.9.5-1.mbs1.x86_64.rpm
d7f4e807a2eecaefd6093f0f33ea9ea7 mbs1/x86_64/lib64nss3-3.14.3-1.mbs1.x86_64.rpm
9da2a0041c6a5045e167254384e1a206 mbs1/x86_64/lib64nss-devel-3.14.3-1.mbs1.x86_64.rpm
0bb2a9b45ef5b7028a722d5400f3d6b8 mbs1/x86_64/lib64nss-static-devel-3.14.3-1.mbs1.x86_64.rpm
b1fd2ec668d9997fb473ffdfec75ad44 mbs1/x86_64/lib64sqlite3_0-3.7.14.1-1.mbs1.x86_64.rpm
13d991069560fb0996d120aab13f6b1d mbs1/x86_64/lib64sqlite3-devel-3.7.14.1-1.mbs1.x86_64.rpm
eb44ebaeccdfc10d7a6e69aa7a1508b1 mbs1/x86_64/lib64sqlite3-static-devel-3.7.14.1-1.mbs1.x86_64.rpm
dc6adf149978589ee2100803f111a369 mbs1/x86_64/nss-3.14.3-1.mbs1.x86_64.rpm
2eeda7041ce9c0a60d655dbaadf4acd7 mbs1/x86_64/nss-doc-3.14.3-1.mbs1.noarch.rpm
e2ba87bfc2e451fcdccea8e4cce04035 mbs1/x86_64/rootcerts-20121229.00-2.mbs1.x86_64.rpm
4fbf4e6a95e4158cdeee7b0363080657 mbs1/x86_64/rootcerts-java-20121229.00-2.mbs1.x86_64.rpm
e96abbea2688dbbfec410b355cc1cf34 mbs1/x86_64/sqlite3-tcl-3.7.14.1-1.mbs1.x86_64.rpm
d82432176de79f30ad57a486c4698f32 mbs1/x86_64/sqlite3-tools-3.7.14.1-1.mbs1.x86_64.rpm
f9b0cc6b037c4cdb1a4446c2074beab6 mbs1/SRPMS/nspr-4.9.5-1.mbs1.src.rpm
55d0827746bb1883c8b9435345636e90 mbs1/SRPMS/nss-3.14.3-1.mbs1.src.rpm
4641c085e1bb7b5abd5fe6aa2a55522e mbs1/SRPMS/rootcerts-20121229.00-2.mbs1.src.rpm
fdd71946b831bbac87a1ee6a6f262a04 mbs1/SRPMS/sqlite3-3.7.14.1-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFRXs87mqjQ0CJFipgRApRiAKDfmdXjMRCxXRr7W07dZkd5EBbggACgvCFx
oo9AI76kr1Dhvb157gF22Cc=
=5H/+
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close