Stay Secure with the Latest Linux Advisories

security advisoryimportantsecurity issues

SUSE Linux 11 SP2 LTSS: 2014:1386-1 Important: OpenSSL Session Leak

An update that fixes four vulnerabilities is now available. An update that fixes four vulnerabilities is now available. An update that fixes four vulnerabilities is now available. It includes one version update. It includes one version update.. SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1386-1 Rating: important References: #892403 #901223 #901277 Cross-References: CVE-2014-3513 CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. It includes one version update. Description: This OpenSSL update fixes the following issues: * Session Ticket Memory Leak (CVE-2014-3567) * Build option no-ssl3 is incomplete ((CVE-2014-3568) * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE) Security Issues: * CVE-2014-3513 * CVE-2014-3567 * CVE-2014-3566 * CVE-2014-3568 Indications: Everybody should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-libopenssl-devel-9928 - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-libopenssl-devel-9927 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): libopenssl-devel-0.9.8j-0.66.1 libopenssl0_9_8-0.9.8j-0.66.1 libopenssl0_9_8-hmac-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1 openssl-doc-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.66.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.9.8j]: libopenssl-devel-0.9.8j-0.66.1 libopenssl0_9_8-0.9.8j-0.66.1 libopenssl0_9_8-hmac-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1 openssl-doc-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 0.9.8j]: libopenssl0_9_8-32bit-0.9.8j-0.66.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1 References: https://www.suse.com/security/cve/CVE-2014-3513.html https://www.suse.com/security/cve/CVE-2014-3566.html https://www.suse.com/security/cve/CVE-2014-3567.html https://www.suse.com/security/cve/CVE-2014-3568.html https://bugzilla.suse.com/show_bug.cgi?id=892403 https://bugzilla.suse.com/show_bug.cgi?id=901223 https://bugzilla.suse.com/show_bug.cgi?id=901277 https://scc.suse.com:443/patches/ https://scc.suse.com:443/patches/ . Essential patch for SUSE Linux tackling OpenSSL vulnerabilities concerning session tickets, safeguard your installations immediately.. SUSE Linux Enterprise, OpenSSL security, patch updates, server protection, risk management. . Severity: Important. LinuxSecurity.com Team

Nov 11, 2014 •Important SuSE