what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2009-238

Mandriva Linux Security Advisory 2009-238
Posted Sep 21, 2009
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2009-238 - Multiple vulnerabilities was discovered and corrected in openssl. This update provides a solution to these vulnerabilities.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2009-1379, CVE-2009-1386, CVE-2009-1387, CVE-2009-2409
SHA-256 | 31c2e4db2c4d9a59061c28ba43c171388869223dfecb57fc075078cb0b97baed

Mandriva Linux Security Advisory 2009-238

Change Mirror Download

Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2009:238

Package : openssl
Date : September 21, 2009
Affected: 2008.1, 2009.0, Enterprise Server 5.0

Problem Description:

Multiple vulnerabilities was discovered and corrected in openssl:

Use-after-free vulnerability in the dtls1_retrieve_buffered_fragment
function in ssl/d1_both.c in OpenSSL 1.0.0 Beta 2 allows remote
attackers to cause a denial of service (openssl s_client crash)
and possibly have unspecified other impact via a DTLS packet, as
demonstrated by a packet from a server that uses a crafted server
certificate (CVE-2009-1379).

ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to
cause a denial of service (NULL pointer dereference and daemon crash)
via a DTLS ChangeCipherSpec packet that occurs before ClientHello

The dtls1_retrieve_buffered_fragment function in ssl/d1_both.c
in OpenSSL before 1.0.0 Beta 2 allows remote attackers to cause a
denial of service (NULL pointer dereference and daemon crash) via
an out-of-sequence DTLS handshake message, related to a fragment
bug. (CVE-2009-1387)

The NSS library library before 3.12.3, as used in Firefox; GnuTLS
before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other
products support MD2 with X.509 certificates, which might allow
remote attackers to spooof certificates by using MD2 design flaws
to generate a hash collision in less than brute-force time. NOTE:
the scope of this issue is currently limited because the amount of
computation required is still large (CVE-2009-2409).

This update provides a solution to these vulnerabilities.



Updated Packages:

Mandriva Linux 2008.1:
4413a38da4754d54fc161e3c06b81c72 2008.1/i586/libopenssl0.9.8-0.9.8g-4.5mdv2008.1.i586.rpm
7994189a9bdff555fa34d763a9eec321 2008.1/i586/libopenssl0.9.8-devel-0.9.8g-4.5mdv2008.1.i586.rpm
bfd128daaf2831e0af5cfd5163067be9 2008.1/i586/libopenssl0.9.8-static-devel-0.9.8g-4.5mdv2008.1.i586.rpm
cb8236b62c2edba4033f1cafa39c4ce5 2008.1/i586/openssl-0.9.8g-4.5mdv2008.1.i586.rpm
e0a15b72d2ef1d458f259368042f6321 2008.1/SRPMS/openssl-0.9.8g-4.5mdv2008.1.src.rpm

Mandriva Linux 2008.1/X86_64:
f12af113949996063624f4c638d5c75c 2008.1/x86_64/lib64openssl0.9.8-0.9.8g-4.5mdv2008.1.x86_64.rpm
0a6db81684a049b45d4536d583864415 2008.1/x86_64/lib64openssl0.9.8-devel-0.9.8g-4.5mdv2008.1.x86_64.rpm
f4f9dd377c41a83af03efe923a0e106e 2008.1/x86_64/lib64openssl0.9.8-static-devel-0.9.8g-4.5mdv2008.1.x86_64.rpm
e317fbadd87171b291584a9275f6b656 2008.1/x86_64/openssl-0.9.8g-4.5mdv2008.1.x86_64.rpm
e0a15b72d2ef1d458f259368042f6321 2008.1/SRPMS/openssl-0.9.8g-4.5mdv2008.1.src.rpm

Mandriva Linux 2009.0:
62125f9fde11ecec42ae21075a34f4c7 2009.0/i586/libopenssl0.9.8-0.9.8h-3.4mdv2009.0.i586.rpm
4e21025e35ffefe8ab4b8a2d5368a450 2009.0/i586/libopenssl0.9.8-devel-0.9.8h-3.4mdv2009.0.i586.rpm
5887cbeeb89f1e9824868d977ae7c83e 2009.0/i586/libopenssl0.9.8-static-devel-0.9.8h-3.4mdv2009.0.i586.rpm
45cf6fd02fadbca35ccfc1dea1e1054e 2009.0/i586/openssl-0.9.8h-3.4mdv2009.0.i586.rpm
2942f8a0a8070f3a59d9bfc6c8fa50c5 2009.0/SRPMS/openssl-0.9.8h-3.4mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
287b7f8b3d478451e16b3e391e348c5e 2009.0/x86_64/lib64openssl0.9.8-0.9.8h-3.4mdv2009.0.x86_64.rpm
a7079cfda34bf4f4db722753244ee41b 2009.0/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.4mdv2009.0.x86_64.rpm
047265cc0d6ac4627f9d82c3b809f362 2009.0/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.4mdv2009.0.x86_64.rpm
9395a6acd0c2546f76da5a318d2f494f 2009.0/x86_64/openssl-0.9.8h-3.4mdv2009.0.x86_64.rpm
2942f8a0a8070f3a59d9bfc6c8fa50c5 2009.0/SRPMS/openssl-0.9.8h-3.4mdv2009.0.src.rpm

Mandriva Enterprise Server 5:
f7162720ce8713b9087cf91f7c2107c1 mes5/i586/libopenssl0.9.8-0.9.8h-3.4mdvmes5.i586.rpm
fb5183cd2e7adf3013f8224363cc5391 mes5/i586/libopenssl0.9.8-devel-0.9.8h-3.4mdvmes5.i586.rpm
e3b7029bd10babd86023f2b3299ec957 mes5/i586/libopenssl0.9.8-static-devel-0.9.8h-3.4mdvmes5.i586.rpm
4dc42b91974a65a75412896c0517a1ac mes5/i586/openssl-0.9.8h-3.4mdvmes5.i586.rpm
ba1f57df4b57fe6ba79dd083a99c1b8d mes5/SRPMS/openssl-0.9.8h-3.4mdvmes5.src.rpm

Mandriva Enterprise Server 5/X86_64:
d17052790ec6dbc7c98acbc552ed1d5a mes5/x86_64/lib64openssl0.9.8-0.9.8h-3.4mdvmes5.x86_64.rpm
cdba1f5866e5cb02efd5abb0671075c2 mes5/x86_64/lib64openssl0.9.8-devel-0.9.8h-3.4mdvmes5.x86_64.rpm
125739bc83e5a75c554e185d40932383 mes5/x86_64/lib64openssl0.9.8-static-devel-0.9.8h-3.4mdvmes5.x86_64.rpm
6a8ce7e9226cba94a43a561e9dff854f mes5/x86_64/openssl-0.9.8h-3.4mdvmes5.x86_64.rpm
ba1f57df4b57fe6ba79dd083a99c1b8d mes5/SRPMS/openssl-0.9.8h-3.4mdvmes5.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:


If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.9 (GNU/Linux)

Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By