Stay Secure with the Latest Linux Advisories

security advisorysecurity updateDoS

Red Hat Enterprise Linux 5: RHSA-2010:0054-01 moderate: OpenSSL Memory Leak

Updated openssl packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Moderate: openssl security update Advisory ID: RHSA-2010:0054-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2010:0054.html Issue date: 2010-01-19 CVE Names: CVE-2009-2409 CVE-2009-4355 ==================================================================== 1. Summary: Updated openssl packages that fix two security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library. It was found that the OpenSSL library did not properly re-initialize its internal state in the SSL_library_init() function after previous calls to the CRYPTO_cleanup_all_ex_data() function, which would cause a memory leak for each subsequent SSL connection. This flaw could cause server applications that call those functions during reload, such as a combination of the Apache HTTP Server, mod_ssl, PHP, and cURL, to consume all available memory, resulting in a denial of service. (CVE-2009-4355) Dan Kaminsky found that browsers could accept certificates with MD2 hash signatures, even though MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an attacker to createa malicious certificate that would be treated as trusted by a browser. OpenSSL now disables the use of the MD2 algorithm inside signatures by default. (CVE-2009-2409) All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 510197 - CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky) 546707 - CVE-2009-4355 openssl significant memory leak in certain SSLv3 requests (DoS) 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: i386: openssl-0.9.8e-12.el5_4.1.i386.rpm openssl-0.9.8e-12.el5_4.1.i686.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i386.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i686.rpm openssl-perl-0.9.8e-12.el5_4.1.i386.rpm x86_64: openssl-0.9.8e-12.el5_4.1.i686.rpm openssl-0.9.8e-12.el5_4.1.x86_64.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i686.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.x86_64.rpm openssl-perl-0.9.8e-12.el5_4.1.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: i386: openssl-debuginfo-0.9.8e-12.el5_4.1.i386.rpm openssl-devel-0.9.8e-12.el5_4.1.i386.rpm x86_64: openssl-debuginfo-0.9.8e-12.el5_4.1.i386.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.x86_64.rpm openssl-devel-0.9.8e-12.el5_4.1.i386.rpm openssl-devel-0.9.8e-12.el5_4.1.x86_64.rpm Red Hat Enterprise Linux (v. 5server): Source: i386: openssl-0.9.8e-12.el5_4.1.i386.rpm openssl-0.9.8e-12.el5_4.1.i686.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i386.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i686.rpm openssl-devel-0.9.8e-12.el5_4.1.i386.rpm openssl-perl-0.9.8e-12.el5_4.1.i386.rpm ia64: openssl-0.9.8e-12.el5_4.1.i686.rpm openssl-0.9.8e-12.el5_4.1.ia64.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i686.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.ia64.rpm openssl-devel-0.9.8e-12.el5_4.1.ia64.rpm openssl-perl-0.9.8e-12.el5_4.1.ia64.rpm ppc: openssl-0.9.8e-12.el5_4.1.ppc.rpm openssl-0.9.8e-12.el5_4.1.ppc64.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.ppc.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.ppc64.rpm openssl-devel-0.9.8e-12.el5_4.1.ppc.rpm openssl-devel-0.9.8e-12.el5_4.1.ppc64.rpm openssl-perl-0.9.8e-12.el5_4.1.ppc.rpm s390x: openssl-0.9.8e-12.el5_4.1.s390.rpm openssl-0.9.8e-12.el5_4.1.s390x.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.s390.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.s390x.rpm openssl-devel-0.9.8e-12.el5_4.1.s390.rpm openssl-devel-0.9.8e-12.el5_4.1.s390x.rpm openssl-perl-0.9.8e-12.el5_4.1.s390x.rpm x86_64: openssl-0.9.8e-12.el5_4.1.i686.rpm openssl-0.9.8e-12.el5_4.1.x86_64.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i386.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.i686.rpm openssl-debuginfo-0.9.8e-12.el5_4.1.x86_64.rpm openssl-devel-0.9.8e-12.el5_4.1.i386.rpm openssl-devel-0.9.8e-12.el5_4.1.x86_64.rpm openssl-perl-0.9.8e-12.el5_4.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2009-2409 https://access.redhat.com/security/cve/CVE-2009-4355 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2010 Red Hat, Inc. . A recent update for OpenSSL targets vulnerabilities in Red Hat Enterprise Linux5, focusing on issues concerning memory management and verification of certificates.. OpenSSL Patch, Red Hat Update, Memory Leak Security, Certificate Validation. . LinuxSecurity.com Team

Jan 19, 2010 Red Hat