Test ID:	1.3.6.1.4.1.25623.1.0.51409
Category:	Conectiva Local Security Checks
Title:	Conectiva Security Advisory CLA-2003:625
Summary:	Conectiva Security Advisory CLA-2003:625
Description:	The remote host is missing updates announced in advisory CLA-2003:625. OpenSSL[1] implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as full-strength general purpose cryptography functions. It is used (as a library) by several projects, like Apache, OpenSSH, Bind, OpenLDAP and many others clients and servers programs. This OpenSSL update addresses the issues outlined below: 1) Klima-Pokorny-Rosa attack (CVE-2003-0131)[2][3] Vlastimil Klima, Ondrej Pokorny and Tomas Rosa published[6] a paper where they present an extension to the Bleichenbacher attack on RSA with PKCS #1 v1.5 padding as used in SSL 3.0 and TLS 1.0. This vulnerability would allow a remote attacker to perform a single RSA private key operation on a ciphertext of his/her choice using the server's RSA key after analysing the server's behaviour with a large number of specially crafted connections. 2) Timing attack (CAN 2003-147)[4][5] D. Boneh and D. Brumley published[7] a paper in which they demonstrate that remote timing attacks are possible and practical against OpenSSL and derived libraries. They successfully extracted private keys from a webserver in a local network. In order to prevent such attacks, a technique known as RSA blinding has been turned on by default in OpenSSL. Additionally, some smaller fixes from newer versions of OpenSSL have been included in the packages provided via this update. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.securityspace.com/smysecure/catid.html?in=CLA-2003:625 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : High
Cross-Ref:	BugTraq ID: 7148 Common Vulnerability Exposure (CVE) ID: CVE-2003-0131 Bugtraq: 20030327 Immunix Secured OS 7+ openssl update (Google Search) http://www.securityfocus.com/archive/1/archive/1/316577/30/25310/threaded http://eprint.iacr.org/2003/052/ Bugtraq: 20030319 [OpenSSL Advisory] Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding (Google Search) http://marc.theaimsgroup.com/?l=bugtraq&m=104811162730834&w=2 Bugtraq: 20030324 GLSA: openssl (200303-20) (Google Search) http://marc.theaimsgroup.com/?l=bugtraq&m=104852637112330&w=2 http://www.linuxsecurity.com/advisories/immunix_advisory-3066.html Caldera Security Advisory: CSSA-2003-014.0 ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt http://www.gentoo.org/security/en/glsa/glsa-200303-20.xml Immunix Linux Advisory: IMNX-2003-7+-001-01 http://www.openpkg.org/security/OpenPKG-SA-2003.026-openssl.html En Garde Linux Advisory: ESA-20030320-010 FreeBSD Security Advisory: FreeBSD-SA-03:06 http://www.mandriva.com/security/advisories?name=MDKSA-2003:035 NETBSD Security Advisory: NetBSD-SA2003-007 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc http://www.redhat.com/support/errata/RHSA-2003-101.html http://www.redhat.com/support/errata/RHSA-2003-102.html Conectiva Linux advisory: CLA-2003:625 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625 Debian Security Information: DSA-288 (Google Search) http://www.debian.org/security/2003/dsa-288 SGI Security Advisory: 20030501-01-I ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I SuSE Security Announcement: SuSE-SA:2003:024 (Google Search) http://www.suse.de/de/security/2003_024_openssl.html http://marc.theaimsgroup.com/?l=bugtraq&m=104878215721135&w=2 http://www.novell.com/linux/security/advisories/2003_024_openssl.html CERT/CC vulnerability note: VU#888801 http://www.kb.cert.org/vuls/id/888801 http://www.securityfocus.com/bid/7148 XForce ISS Database: ssl-premaster-information-leak(11586) http://xforce.iss.net/xforce/xfdb/11586 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:461
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: