|Category:||Mandrake Local Security Checks|
|Title:||Mandrake Security Advisory MDKSA-2003:098 (openssl)|
|Summary:||Mandrake Security Advisory MDKSA-2003:098 (openssl)|
The remote host is missing an update to openssl
announced via advisory MDKSA-2003:098.
Two bugs were discovered in OpenSSL 0.9.6 and 0.9.7 by NISCC. The
parsing of unusual ASN.1 tag values can cause OpenSSL to crash, which
could be triggered by a remote attacker by sending a carefully-crafted
SSL client certificate to an application. Depending upon the
application targetted, the effects seen will vary
in some cases a DoS
(Denial of Service) could be performed, in others nothing noticeable
or adverse may happen. These two vulnerabilities have been assigned
CVE-2003-0543 and CVE-2003-0544.
Additionally, NISCC discovered a third bug in OpenSSL 0.9.7. Certain
ASN.1 encodings that are rejected as invalid by the parser can trigger
a bug in deallocation of a structure, leading to a double free. This
can be triggered by a remote attacker by sending a carefully-crafted
SSL client certificate to an application. This vulnerability may be
exploitable to execute arbitrary code. This vulnerability has been
The packages provided have been built with patches provided by the
OpenSSL group that resolve these issues.
A number of server applications such as OpenSSH and Apache that make
use of OpenSSL need to be restarted after the update has been applied
to ensure that they are protected from these issues. Users are
encouraged to restart all of these services or reboot their systems.
Affected versions: 8.2, 9.0, 9.1, 9.2, Corporate Server 2.1,
Multi Network Firewall 8.2
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
Risk factor : Critical
Common Vulnerability Exposure (CVE) ID: CVE-2003-0543|
En Garde Linux Advisory: ESA-20030930-027
Debian Security Information: DSA-393 (Google Search)
Debian Security Information: DSA-394 (Google Search)
CERT/CC vulnerability note: VU#255484
BugTraq ID: 8732
Common Vulnerability Exposure (CVE) ID: CVE-2003-0544
CERT/CC vulnerability note: VU#380864
XForce ISS Database: openssl-asn1-sslclient-dos(43041)
Common Vulnerability Exposure (CVE) ID: CVE-2003-0545
CERT/CC vulnerability note: VU#935264
|Copyright||Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com|
|This is only one of 51507 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.