Packet Storm

Mandriva Linux Security Advisory 2011-137: Posted Sep 28, 2011; Authored by Mandriva | Site mandriva.com; Mandriva Linux Security Advisory 2011-137 - The elliptic curve cryptography subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation. crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past. The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8s and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages, which allows remote attackers to cause a denial of service via out-of-order messages that violate the TLS protocol.; tags | advisory, remote, denial of service, cryptography, protocol; systems | linux, mandriva; advisories | CVE-2011-1945, CVE-2011-3207, CVE-2011-3210; SHA-256 | 83fe8b76f3683d9eb0fcf02ef6b3ea18f900160bf76d8b38af1184c342723125; Download | Favorite | View

Related Files

No related files