Scientific Linux alert SLSA-2014:0625-1 (openssl)

From:
    	     
 
Pat Riehecky <riehecky@fnal.gov> 
To:
    	     
 
<scientific-linux-errata@listserv.fnal.gov> 
Subject:
    	     
 
Security ERRATA Important: openssl on SL6.x i386/x86_64 
Date:
    	     
 
Thu, 5 Jun 2014 14:47:41 +0000
Message-ID:
    	     
 
<20140605144741.7007.35821@slpackages.fnal.gov>
Synopsis:          Important: openssl security update
Advisory ID:       SLSA-2014:0625-1
Issue Date:        2014-06-05
CVE Numbers:       CVE-2010-5298
                   CVE-2014-0198
                   CVE-2014-0224
                   CVE-2014-0221
                   CVE-2014-0195
                   CVE-2014-3470
--

It was found that OpenSSL clients and servers could be forced, via a
specially crafted handshake packet, to use weak keying material for
communication. A man-in-the-middle attacker could use this flaw to decrypt
and modify traffic between a client and a server. (CVE-2014-0224)

Note: In order to exploit this flaw, both the server and the client must
be using a vulnerable version of OpenSSL; the server must be using OpenSSL
version 1.0.1 and above, and the client must be using any version of
OpenSSL. For more information about this flaw, refer to:

A buffer overflow flaw was found in the way OpenSSL handled invalid DTLS
packet fragments. A remote attacker could possibly use this flaw to
execute arbitrary code on a DTLS client or server. (CVE-2014-0195)

Multiple flaws were found in the way OpenSSL handled read and write
buffers when the SSL_MODE_RELEASE_BUFFERS mode was enabled. A TLS/SSL
client or server using OpenSSL could crash or unexpectedly drop
connections when processing certain SSL traffic. (CVE-2010-5298,
CVE-2014-0198)

A denial of service flaw was found in the way OpenSSL handled certain DTLS
ServerHello requests. A specially crafted DTLS handshake packet could
cause a DTLS client using OpenSSL to crash. (CVE-2014-0221)

A NULL pointer dereference flaw was found in the way OpenSSL performed
anonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A specially
crafted handshake packet could cause a TLS/SSL client that has the
anonymous ECDH cipher suite enabled to crash. (CVE-2014-3470)

For the update to take effect, all services linked to the OpenSSL library
(such as httpd and other SSL-enabled services) must be restarted or the
system rebooted.
--

SL6
  x86_64
    openssl-1.0.1e-16.el6_5.14.i686.rpm
    openssl-1.0.1e-16.el6_5.14.x86_64.rpm
    openssl-debuginfo-1.0.1e-16.el6_5.14.i686.rpm
    openssl-debuginfo-1.0.1e-16.el6_5.14.x86_64.rpm
    openssl-devel-1.0.1e-16.el6_5.14.i686.rpm
    openssl-devel-1.0.1e-16.el6_5.14.x86_64.rpm
    openssl-perl-1.0.1e-16.el6_5.14.x86_64.rpm
    openssl-static-1.0.1e-16.el6_5.14.x86_64.rpm
  i386
    openssl-1.0.1e-16.el6_5.14.i686.rpm
    openssl-debuginfo-1.0.1e-16.el6_5.14.i686.rpm
    openssl-devel-1.0.1e-16.el6_5.14.i686.rpm
    openssl-perl-1.0.1e-16.el6_5.14.i686.rpm
    openssl-static-1.0.1e-16.el6_5.14.i686.rpm

- Scientific Linux Development Team