Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2015:1183-2

Опубликовано: 19 июн. 2015
Источник: suse-cvrf

Описание

Security update for compat-openssl097g

OpenSSL was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed by rejecting connections with DH parameters shorter than 1024 bits. 2048-bit DH parameters are now generated by default. * CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed. * CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent was fixed. * Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled. This will only get active if applications get rebuilt and actually use this string. (bsc#931698)

Security Issues:

* CVE-2015-1789 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789> * CVE-2015-1790 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790> * CVE-2015-4000 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Список пакетов

SUSE Linux Enterprise Desktop 11 SP3
compat-openssl097g-0.9.7g-146.22.31.1
compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3
compat-openssl097g-0.9.7g-146.22.31.1
compat-openssl097g-32bit-0.9.7g-146.22.31.1

Ссылки

Описание

The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote attackers to cause a denial of service (invalid read operation and application crash) via a crafted X.509 certificate to an endpoint that uses the certificate-verification feature.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer dereference and application crash) via an invalid certificate key.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки

Описание

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

Затронутые продукты
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Desktop 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-0.9.7g-146.22.31.1
SUSE Linux Enterprise Server for SAP Applications 11 SP3:compat-openssl097g-32bit-0.9.7g-146.22.31.1
Ссылки
Уязвимость SUSE-SU-2015:1183-2