Skip to navigation

Security Advisory Moderate: openssl security update

Advisory: RHSA-2007:0813-2
Type: Security Advisory
Severity: Moderate
Issued on: 2007-10-22
Last updated on: 2007-10-22
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 2.1)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org): CVE-2007-3108
CVE-2007-5135

Details

Updated OpenSSL packages that correct security issues are now available for
Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and
Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.

A flaw was found in the SSL_get_shared_ciphers() utility function. An
attacker could send a list of ciphers to an application that used this
function and overrun a buffer with a single byte (CVE-2007-5135). Few
applications make use of this vulnerable function and generally it is used
only when applications are compiled for debugging.

A number of possible side-channel attacks were discovered affecting
OpenSSL. A local attacker could possibly obtain RSA private keys being
used on a system. In practice these attacks would be difficult to perform
outside of a lab environment. This update contains backported patches
designed to mitigate these issues. (CVE-2007-3108).

Users of OpenSSL should upgrade to these updated packages, which contain
backported patches to resolve these issues.

Note: After installing this update, users are advised to either restart all
services that use OpenSSL or restart their system.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Updated packages

Red Hat Desktop (v. 3)

SRPMS:
openssl-0.9.7a-33.24.src.rpm
File outdated by:  RHSA-2010:0163
    MD5: b2e9f291195f6a8e3b6b77d1722e4c32
 
IA-32:
openssl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: db30d33b3590d5267f22c355953ec333
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-devel-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: b4744e8c4e8322691cdf8a74f382d291
openssl-perl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: e89ed20c06ce1cbe489fb58043b06986
 
x86_64:
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 4c79a9941bb91499b5c82f7966a35843
openssl-devel-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 8b47a2b03491fc3dab25b4d9d2304fa1
openssl-perl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 969b865272c1bba25e03fc4523432f9b
 
Red Hat Enterprise Linux AS (v. 2.1)

SRPMS:
openssl-0.9.6b-48.src.rpm
File outdated by:  RHSA-2009:0004
    MD5: 241c11e07657d431d82299dcdace1538
 
IA-32:
openssl-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: e733431a8c900a5f6cda4ee24ff4370a
openssl-0.9.6b-48.i686.rpm
File outdated by:  RHSA-2009:0004
    MD5: de59b644999b3c60c22b9ee707b3ad27
openssl-devel-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: 29a57ca9b091d27649aa00fe28916011
openssl-perl-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: 8ddaf7d36daa25228d589b0b418518c7
 
IA-64:
openssl-0.9.6b-48.ia64.rpm
File outdated by:  RHSA-2009:0004
    MD5: 7b3744aaf24edc10108b035eb4201e8a
openssl-devel-0.9.6b-48.ia64.rpm
File outdated by:  RHSA-2009:0004
    MD5: b4ef30aa6c02c246af8ecc6239bd27c9
openssl-perl-0.9.6b-48.ia64.rpm
File outdated by:  RHSA-2009:0004
    MD5: 1f73927a5997209a03d171b241fea780
 
Red Hat Enterprise Linux AS (v. 3)

SRPMS:
openssl-0.9.7a-33.24.src.rpm
File outdated by:  RHSA-2010:0163
    MD5: b2e9f291195f6a8e3b6b77d1722e4c32
 
IA-32:
openssl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: db30d33b3590d5267f22c355953ec333
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-devel-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: b4744e8c4e8322691cdf8a74f382d291
openssl-perl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: e89ed20c06ce1cbe489fb58043b06986
 
IA-64:
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 3b73e6c1ddea4868fb9ca1ef0d0e8908
openssl-devel-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 9094dc39705ac75c3418f6f1038f1544
openssl-perl-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 5b421c027aa30dd7ac5e9ecd67183cb4
 
PPC:
openssl-0.9.7a-33.24.ppc.rpm
File outdated by:  RHSA-2010:0163
    MD5: c762fa662388f5a5275b7dde930b2248
openssl-0.9.7a-33.24.ppc64.rpm
File outdated by:  RHSA-2010:0163
    MD5: be5500db07523ca80a9c3c0d76d9c60c
openssl-devel-0.9.7a-33.24.ppc.rpm
File outdated by:  RHSA-2010:0163
    MD5: a5aeeed998d77dec869f595cd3315bc8
openssl-perl-0.9.7a-33.24.ppc.rpm
File outdated by:  RHSA-2010:0163
    MD5: 86ccb62b0a712d5d98a229f9545dccd4
 
s390:
openssl-0.9.7a-33.24.s390.rpm
File outdated by:  RHSA-2010:0163
    MD5: 9eccbeb0fcc59b9218d082f9c85b5ea1
openssl-devel-0.9.7a-33.24.s390.rpm
File outdated by:  RHSA-2010:0163
    MD5: c6e9aec6b0a2d7500c64d964d2b742b7
openssl-perl-0.9.7a-33.24.s390.rpm
File outdated by:  RHSA-2010:0163
    MD5: db1be7fee72ff6d686cca42bc40cbfe9
 
s390x:
openssl-0.9.7a-33.24.s390.rpm
File outdated by:  RHSA-2010:0163
    MD5: 9eccbeb0fcc59b9218d082f9c85b5ea1
openssl-0.9.7a-33.24.s390x.rpm
File outdated by:  RHSA-2010:0163
    MD5: 443dd8a5a6434f373d9ac8ae9974e6b4
openssl-devel-0.9.7a-33.24.s390x.rpm
File outdated by:  RHSA-2010:0163
    MD5: b5ece9779173a3012a9b33bafb04fc36
openssl-perl-0.9.7a-33.24.s390x.rpm
File outdated by:  RHSA-2010:0163
    MD5: 312156b73990ad5d8ab0ca6f4bf09d3c
 
x86_64:
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 4c79a9941bb91499b5c82f7966a35843
openssl-devel-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 8b47a2b03491fc3dab25b4d9d2304fa1
openssl-perl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 969b865272c1bba25e03fc4523432f9b
 
Red Hat Enterprise Linux ES (v. 2.1)

SRPMS:
openssl-0.9.6b-48.src.rpm
File outdated by:  RHSA-2009:0004
    MD5: 241c11e07657d431d82299dcdace1538
 
IA-32:
openssl-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: e733431a8c900a5f6cda4ee24ff4370a
openssl-0.9.6b-48.i686.rpm
File outdated by:  RHSA-2009:0004
    MD5: de59b644999b3c60c22b9ee707b3ad27
openssl-devel-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: 29a57ca9b091d27649aa00fe28916011
openssl-perl-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: 8ddaf7d36daa25228d589b0b418518c7
 
Red Hat Enterprise Linux ES (v. 3)

SRPMS:
openssl-0.9.7a-33.24.src.rpm
File outdated by:  RHSA-2010:0163
    MD5: b2e9f291195f6a8e3b6b77d1722e4c32
 
IA-32:
openssl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: db30d33b3590d5267f22c355953ec333
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-devel-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: b4744e8c4e8322691cdf8a74f382d291
openssl-perl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: e89ed20c06ce1cbe489fb58043b06986
 
IA-64:
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 3b73e6c1ddea4868fb9ca1ef0d0e8908
openssl-devel-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 9094dc39705ac75c3418f6f1038f1544
openssl-perl-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 5b421c027aa30dd7ac5e9ecd67183cb4
 
x86_64:
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 4c79a9941bb91499b5c82f7966a35843
openssl-devel-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 8b47a2b03491fc3dab25b4d9d2304fa1
openssl-perl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 969b865272c1bba25e03fc4523432f9b
 
Red Hat Enterprise Linux WS (v. 2.1)

SRPMS:
openssl-0.9.6b-48.src.rpm
File outdated by:  RHSA-2009:0004
    MD5: 241c11e07657d431d82299dcdace1538
 
IA-32:
openssl-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: e733431a8c900a5f6cda4ee24ff4370a
openssl-0.9.6b-48.i686.rpm
File outdated by:  RHSA-2009:0004
    MD5: de59b644999b3c60c22b9ee707b3ad27
openssl-devel-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: 29a57ca9b091d27649aa00fe28916011
openssl-perl-0.9.6b-48.i386.rpm
File outdated by:  RHSA-2009:0004
    MD5: 8ddaf7d36daa25228d589b0b418518c7
 
Red Hat Enterprise Linux WS (v. 3)

SRPMS:
openssl-0.9.7a-33.24.src.rpm
File outdated by:  RHSA-2010:0163
    MD5: b2e9f291195f6a8e3b6b77d1722e4c32
 
IA-32:
openssl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: db30d33b3590d5267f22c355953ec333
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-devel-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: b4744e8c4e8322691cdf8a74f382d291
openssl-perl-0.9.7a-33.24.i386.rpm
File outdated by:  RHSA-2010:0163
    MD5: e89ed20c06ce1cbe489fb58043b06986
 
IA-64:
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 3b73e6c1ddea4868fb9ca1ef0d0e8908
openssl-devel-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 9094dc39705ac75c3418f6f1038f1544
openssl-perl-0.9.7a-33.24.ia64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 5b421c027aa30dd7ac5e9ecd67183cb4
 
x86_64:
openssl-0.9.7a-33.24.i686.rpm
File outdated by:  RHSA-2010:0163
    MD5: e6e165ab5f3774c2494865920f0773a0
openssl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 4c79a9941bb91499b5c82f7966a35843
openssl-devel-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 8b47a2b03491fc3dab25b4d9d2304fa1
openssl-perl-0.9.7a-33.24.x86_64.rpm
File outdated by:  RHSA-2010:0163
    MD5: 969b865272c1bba25e03fc4523432f9b
 
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

SRPMS:
openssl-0.9.6b-48.src.rpm
File outdated by:  RHSA-2009:0004
    MD5: 241c11e07657d431d82299dcdace1538
 
IA-64:
openssl-0.9.6b-48.ia64.rpm
File outdated by:  RHSA-2009:0004
    MD5: 7b3744aaf24edc10108b035eb4201e8a
openssl-devel-0.9.6b-48.ia64.rpm
File outdated by:  RHSA-2009:0004
    MD5: b4ef30aa6c02c246af8ecc6239bd27c9
openssl-perl-0.9.6b-48.ia64.rpm
File outdated by:  RHSA-2009:0004
    MD5: 1f73927a5997209a03d171b241fea780
 

Bugs fixed (see bugzilla for more information)

245732 - CVE-2007-3108 RSA side-channel attack
250573 - CVE-NONE openssl branch prediction attacks
309801 - CVE-2007-5135 openssl SSL_get_shared_ciphers() off-by-one


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/