Date: Wed, 26 Mar 2003 18:24:12 -0800
From: Immunix Security Team <[email protected]>
To: [email protected], [email protected]Subject: Immunix Secured OS 7+ openssl update
--oyUTqETQ0mS9luUI
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
-----------------------------------------------------------------------
Immunix Secured OS Security Advisory
Packages updated: openssl, openssh, mod_ssl
Affected products: ImmunixOS 6.2, 7.0, 7+
Bugs fixed: CAN-2003-0131 CAN-2003-0147
Date: Wed Mar 26 2003
Advisory ID: IMNX-2003-7+-001-01
Author: Seth Arnold <[email protected]>
-----------------------------------------------------------------------
Description:
This update fixes two problems with openssl packages and recompiles
openssh and mod_ssl against the new version of openssl. Quoting from
the OpenSSL advisory:
Vlastimil Klima, Ondrej Pokorny, and Tomas Rosa have come up with an
extension of the "Bleichenbacher attack" on RSA with PKCS #1 v1.5
padding as used in SSL 3.0 and TLS 1.0. Their attack requires the
attacker to open millions of SSL/TLS connections to the server under
attack; the server's behaviour when faced with specially made-up RSA
ciphertexts can reveal information that in effect allows the attacker
to perform a single RSA private key operation on a ciphertext of
its choice using the server's RSA key. Note that the server's RSA
key is not compromised in this attack.
The other problem, quoting from the CERT advisory: David Brumley and Dan
Boneh, researchers at Stanford University, have written a paper that
demonstrates a practical attack that can be used to extract private
keys from vulnerable RSA applications. Using statistical techniques
and carefully measuring the amount of time required to complete an
RSA operation, an attacker can recover one of the factors (q) of the
RSA key. [...] Under optimal conditions, a 1024-bit RSA private key
was extracted in approximately two hours using ~350,000 guesses.
References: http://www.kb.cert.org/vuls/id/997481http://www.openssl.org/news/secadv_20030319.txt
Package names and locations:
Precompiled binary packages for Immunix 7+ are available at:
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/mod_ssl-2.8.12-1.7_=
imnx_2.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/openssh-3.4p1-1_imn=
x_10.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/openssh-askpass-3.4=
p1-1_imnx_10.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/openssh-clients-3.4=
p1-1_imnx_10.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/openssh-server-3.4p=
1-1_imnx_10.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/openssl-0.9.6g-1_im=
nx_2.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/openssl-devel-0.9.6=
g-1_imnx_2.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/openssl-perl-0.9.6g=
-1_imnx_2.i386.rpm
Immunix OS 7+ md5sums:
17a8a4c07a421c0b0a98369d77d06ed4 openssh-3.4p1-1_imnx_10.i386.rpm
59bffcfb9ca2fbe74e9d2eb3568d134a openssh-askpass-3.4p1-1_imnx_10.i386.rpm
37d2acf53c72ee23e5f9576557a5fd6e openssh-clients-3.4p1-1_imnx_10.i386.rpm
d61f9a2c3fc41f8dded88f2b84be2a83 openssh-server-3.4p1-1_imnx_10.i386.rpm
ccb8fa2cce44efa243d368cf7785b9cf openssl-0.9.6g-1_imnx_2.i386.rpm
0ba9e8a2c9728a64ee4a89aa2cecd804 openssl-devel-0.9.6g-1_imnx_2.i386.rpm
fa6f0d1dde78b941a8bc9147dfd7a5b6 openssl-perl-0.9.6g-1_imnx_2.i386.rpm
490d4340e153daff3e3e4e548321e5af mod_ssl-2.8.12-1.7_imnx_2.i386.rpm
GPG verification: =
=20
Our public key is available at <http://wirex.com/security/GPG_KEY>;. =
=20
NOTE:
Ibiblio is graciously mirroring our updates, so if the links above are
slow, please try:
ftp://ftp.ibiblio.org/pub/Linux/distributions/immunix/
or one of the many mirrors available at:
http://www.ibiblio.org/pub/Linux/MIRRORS.html
ImmunixOS 6.2 is no longer officially supported.
ImmunixOS 7.0 is no longer officially supported.
Contact information:
To report vulnerabilities, please contact [email protected]. WireX=20
attempts to conform to the RFP vulnerability disclosure protocol
<http://www.wiretrip.net/rfp/policy.html>;.
--oyUTqETQ0mS9luUI
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAj6CYMsACgkQVQcWL60UVMtsMgCfQJs0y0mZjsgVYf0SHSFZIDde
1JoAn09iu1xFn+FycWFPoHpv6gg9ouK+
=mj7P
-----END PGP SIGNATURE-----
--oyUTqETQ0mS9luUI--
