OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2006.021
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2006.021
Advisory Published:      2008-10-06 16:23 UTC

Issue Id (internal):     OpenPKG-SI-20060928.01
Issue First Created:     2006-09-28
Issue Last Modified:     2006-12-07
Issue Revision:          10


Subject Name:            OpenSSL
Subject Summary:         Cryptography and SSL/TLS Toolkit
Subject Home:            http://www.openssl.org/
Subject Versions:        * <= 0.9.8c

Vulnerability Id:        CVE-2006-2937, CVE-2006-2940, CVE-2006-3738,
                         CVE-2006-4343
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           denial of service

Description:
    According to a vendor security advisory [0], four security issues
    were discovered in the cryptography and SSL/TLS toolkit OpenSSL [1]:
    
    1. ASN.1 Denial of Service Attack (1/2)
    
       During the parsing of certain invalid ASN.1 structures an error
       condition is mishandled. This can result in an infinite loop which
       consumes system memory. CVE-2006-2937
    
    2. ASN.1 Denial of Service Attack (2/2)
    
       Certain types of public key can take disproportionate amounts of
       time to process. This could be used by an attacker in a denial of
       service attack. CVE-2006-2940
    
    3. SSL_get_shared_ciphers() Buffer Overflow
    
       A buffer overflow was discovered in the SSL_get_shared_ciphers()
       utility function. An attacker could send a list of ciphers to an
       application that uses this function and overrun a buffer.
       CVE-2006-3780
    
    4. SSLv2 Client Crash
    
       A flaw in the SSLv2 client code was discovered. When a client
       application used OpenSSL to create an SSLv2 connection to a
       malicious server, that server could cause the client to crash.
       CVE-2006-4343

References:
    [0] http://www.openssl.org/news/secadv_20060928.txt
    [1] http://www.openssl.org/


Primary Package Name:    openssl
Primary Package Home:    http://openpkg.org/go/package/openssl

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        2.5-SOLID         openssl-0.9.8a-2.5.2
OpenPKG Community        2-STABLE          openssl-0.9.8c-2.20060906
OpenPKG Community        CURRENT           openssl-0.9.8c-20060905

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        2.5-SOLID         openssl-0.9.8a-2.5.3
OpenPKG Community        2-STABLE          openssl-0.9.8d-2.20060928
OpenPKG Community        CURRENT           openssl-0.9.8d-20060928