Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Slackware: 2006-272-01 Critical: OpenSSL DoS And Memory Leak Advisory

slackware
Calendar Grey September 29, 2006
Scroller Slackware
Fresh OpenSSL releases for Slackware address serious vulnerabilities linked to potential denial of service exploits and memory corruption scenarios.
New openssl packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues

Summary

Here are the details from the Slackware 10.2 ChangeLog: patches/packages/openssl-0.9.7l-i486-1_slack10.2.tgz: Upgraded to shared libraries from openssl-0.9.7l. See openssl package update below. (* Security fix *) patches/packages/openssl-0.9.7l-i486-1_slack10.2.tgz: Upgraded to openssl-0.9.7l. This fixes a few security related issues: During the parsing of certain invalid ASN.1 structures an error condition is mishandled. This can result in an infinite loop which consumes system memory (CVE-2006-2937). (This issue did not affect OpenSSL versions prior to 0.9.7) Thanks to Dr S. N. Henson of Open Network Security and NISCC. Certain types of public key can take disproportionate amounts of time to process. This could be used by an attacker in a denial of service attack (CVE-2006-2940). Thanks to Dr S. N. Henson of Open Network Security and NISCC. A buffer overflow was discovered in the SSL_get_shared_ciphers() utility

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory software update DoS attack OpenSSL memory leak Slackware critical severity

Where Find New Packages

HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading from ftp.slackware.com.
Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated packages for Slackware 9.0: ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-solibs-0.9.7l-i386-1_slack9.0.tgz ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-0.9.7l-i386-1_slack9.0.tgz
Updated packages for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-solibs-0.9.7l-i486-1_slack9.1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-0.9.7l-i486-1_slack9.1.tgz
Updated packages for Slack...

Read the Full Advisory

MD5 Signatures

Slackware 9.0 packages: 3b17c8be79ca99cb16321d2675f2885d openssl-0.9.7l-i386-1_slack9.0.tgz a7cb86681f01b57f7bff49842b393a67 openssl-solibs-0.9.7l-i386-1_slack9.0.tgz
Slackware 9.1 packages: f222c26925ce542a25a93df674e8106c openssl-0.9.7l-i486-1_slack9.1.tgz fca221391f0b591373b6e38f1d732d63 openssl-solibs-0.9.7l-i486-1_slack9.1.tgz
Slackware 10.0 packages: a1013cef56210154a2259c5135f1d047 openssl-0.9.7l-i486-1_slack10.0.tgz 35c40208e50ca4bcd7e7e16ce5db1526 openssl-solibs-0.9.7l-i486-1_slack10.0.tgz
Slackware 10.1 packages: 6c87f5baca8855cd07031824b747fe80 openssl-0.9.7l-i486-1_slack10.1.tgz 3ae63bd5b7178f880e8ed5a3af602b50 openssl-solibs-0.9.7l-i486-1_slack10.1.tgz
Slackware 10.2 packages: a97c874a4bf6dc4ca6a4617966108a45 openssl-0.9.7l-i486-1_slack10.2.tgz 06b462fad82d28af4fba3f35f2ed25a1 openssl-solibs-0.9.7l-i486-1_slack10.2.tgz
Slackware -current package: 88264ebbe45eb908c2d3f3f32c367cf6 openssl-solibs-0.9.8d-i486-1.tgz 9f9d2d98fefd5cbd9334cfa374934efa openssl-0.9.8d-i486-1.tgz

Severity
critical
Lowest
Low
Medium
High
Critical

Topics%20covered

Topics Covered

security advisory software update DoS attack OpenSSL memory leak Slackware critical severity

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the packages as root: # upgradepkg openssl-solibs-0.9.7l-i486-1_slack10.2.tgz openssl-0.9.7l-i486-1_slack10.2.tgz