Mageia alert MGASA-2014-0325 (openssl)
| From: | Mageia Updates <buildsystem-daemon@mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2014-0325: Updated openssl packages fix security vulnerabilities | |
| Date: | Tue, 12 Aug 2014 11:17:00 +0200 | |
| Message-ID: | <20140812091700.6339A5CC72@valstar.mageia.org> |
MGASA-2014-0325 - Updated openssl packages fix security vulnerabilities Publication date: 12 Aug 2014 URL: http://advisories.mageia.org/MGASA-2014-0325.html Type: security Affected Mageia releases: 3, 4 CVE: CVE-2014-3505, CVE-2014-3506, CVE-2014-3507, CVE-2014-3508, CVE-2014-3509, CVE-2014-3510, CVE-2014-3511, CVE-2014-3512, CVE-2014-5139 Description: A flaw in OBJ_obj2txt may cause pretty printing functions such as X509_name_oneline, X509_name_print_ex et al. to leak some information from the stack. Applications may be affected if they echo pretty printing output to the attacker. OpenSSL SSL/TLS clients and servers themselves are not affected (CVE-2014-3508). The issue affects OpenSSL clients and allows a malicious server to crash the client with a null pointer dereference (read) by specifying an SRP ciphersuite even though it was not properly negotiated with the client. This can be exploited through a Denial of Service attack (CVE-2014-5139). If a multithreaded client connects to a malicious server using a resumed session and the server sends an ec point format extension it could write up to 255 bytes to freed memory (CVE-2014-3509). An attacker can force an error condition which causes openssl to crash whilst processing DTLS packets due to memory being freed twice. This can be exploited through a Denial of Service attack (CVE-2014-3505). An attacker can force openssl to consume large amounts of memory whilst processing DTLS handshake messages. This can be exploited through a Denial of Service attack (CVE-2014-3506). By sending carefully crafted DTLS packets an attacker could cause openssl to leak memory. This can be exploited through a Denial of Service attack (CVE-2014-3507). OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject to a denial of service attack. A malicious server can crash the client with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages (CVE-2014-3510). A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate TLS 1.0 instead of higher protocol versions when the ClientHello message is badly fragmented. This allows a man-in-the-middle attacker to force a downgrade to TLS 1.0 even if both the server and the client support a higher protocol version, by modifying the client's TLS records (CVE-2014-3511). A malicious client or server can send invalid SRP parameters and overrun an internal buffer. Only applications which are explicitly set up for SRP use are affected (CVE-2014-3512). References: - https://bugs.mageia.org/show_bug.cgi?id=13874 - http://www.openssl.org/news/secadv_20140806.txt - https://www.debian.org/security/2014/dsa-2998 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3505 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3506 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3507 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3508 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3509 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3510 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3511 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3512 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5139 SRPMS: - 4/core/openssl-1.0.1e-8.7.mga4 - 3/core/openssl-1.0.1e-1.10.mga3