OpenSSL implements the Secure Sockets Layer (SSL v2/v3) and
Transport Layer Security (TLS v1) protocols as well as full-strength
general purpose cryptography functions. It's used (as a library) by
several projects, like Apache, OpenSSH, Bind, OpenLDAP and many
others clients and servers programs.
This update fixes three denial of service vulnerabilities that affect
OpenSSL versions distributed with Conectiva Linux:
CAN-2004-0079: Null-pointer assignment during SSL handshake. A
remote attacker can exploit this vulnerability by performing a
specially crafted SSL handshake that will crash the application. This
vulnerability was discovered by the OpenSSL team using the
Codenomicon TLS Test Tool and affects OpenSSL versions distributed
with Conectiva Linux 8 (0.9.6c) and 9 (0.9.7a).
CAN-2004-0081: Infinite loop when handling unknown TLS message
types. A remote attacker can exploit this vulnerability by sending
specially crafted TLS messages, causing the application to enter an
infinite loop. Conectiva Linux 9 (OpenSSL-0.9.7a) is not vulnerable
to this issue.
CAN-2004-0112: Out-of-bounds read with Kerberos ciphersuites.
Stephen Henson discovered a vulnerability in the SSL/TLS handshaking
code when using Kerberos ciphersuites. A remote attacker can exploit
it to crash an application which uses Kerberos ciphersuites. The
OpenSSL version distributed with Conectiva Linux 8 (OpenSSL-0.9.6c)
is not vulnerable to this issue and there are no known applications
using Kerberos ciphersuites in Conectiva Linux 9.
All openssl users should upgrade.
Please notice that in order to complete the upgrade process, you must
restart all running aplications that are linked to openssl libraries
after the new packages are installed. You can see a list of such
applications using the lsof utility, as seen below:
# lsof | egrep '(libcrypto|libssl)'
Services (like apache and openssh daemons) can be restarted using the
"service" command. For example: