Skip to navigation

Security Advisory Updated OpenSSL packages fix timing attack

Advisory: RHSA-2003:062-11
Type: Security Advisory
Severity: N/A
Issued on: 2003-03-06
Last updated on: 2003-03-06
Affected Products: Red Hat Linux 6.2
Red Hat Linux 7.0
Red Hat Linux 7.1
Red Hat Linux 7.2
Red Hat Linux 7.3
Red Hat Linux 8.0
CVEs (cve.mitre.org): CVE-2003-0078

Details

Updated OpenSSL packages are available that fix a potential timing-based
attack.

OpenSSL is a commercial-grade, full-featured, and open source toolkit that
implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols as well as a full-strength general purpose
cryptography library.

In a paper, Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin
Vuagnoux describe and demonstrate a timing-based attack on CBC ciphersuites
in SSL and TLS. An active attacker may be able to use timing observations
to distinguish between two different error cases: cipher padding errors and
MAC verification errors. Over multiple connections this can leak
sufficient information to make it possible to retrieve the plaintext of a
common, fixed block.

In order for an attack to be sucessful, an attacker must be able to act as
a man-in-the-middle to intercept and modify multiple connections, which all
involve a common fixed plaintext block (such as a password), and have good
network conditions that allow small changes in timing to be reliably
observed.

These erratum packages contain a patch provided by the OpenSSL group that
corrects this vulnerability.

Because server applications are affected by these vulnerabilities, we
advise users to restart all services that use OpenSSL functionality or
alternatively reboot their systems after installing these updates.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Updated packages

Red Hat Linux 6.2

IA-32:
openssl-0.9.5a-30.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: 89f90fbdbf3731f4cd0af1f362ff10bc
openssl-devel-0.9.5a-30.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: aeba8db707ac96a25dac61586b547ea5
openssl-perl-0.9.5a-30.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: 8b94e526b689a4a6325031b380ec7b37
openssl-python-0.9.5a-30.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: 4e9fb9fcea2d4d6c9c9f5d0d500b94e1
 
Red Hat Linux 7.0

SRPMS:
openssl-0.9.6-14.src.rpm
File outdated by:  RHSA-2003:291
    MD5: b1306cc627ed2eee6583cda7318c5d21
openssl095a-0.9.5a-18.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 4eeca68ad45a889cf99e9888244f811f
 
IA-32:
openssl-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: eafaadaed7be24dfe9f1335d9de6af19
openssl-devel-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: 5da72b7b35a9d8529316bd34810406c8
openssl-perl-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: e2d6359f0569c7da631d72f80fe16735
openssl-python-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: 96088bee90bd4c827731316581ce598e
openssl095a-0.9.5a-18.7.i386.rpm
File outdated by:  RHSA-2003:101
    MD5: 0c8458c5fe99f2dccbd99fc1471e579d
 
Red Hat Linux 7.1

SRPMS:
openssl-0.9.6-14.src.rpm
File outdated by:  RHSA-2003:291
    MD5: b1306cc627ed2eee6583cda7318c5d21
openssl095a-0.9.5a-18.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 4eeca68ad45a889cf99e9888244f811f
 
IA-32:
openssl-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: eafaadaed7be24dfe9f1335d9de6af19
openssl-devel-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 5da72b7b35a9d8529316bd34810406c8
openssl-perl-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: e2d6359f0569c7da631d72f80fe16735
openssl-python-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 96088bee90bd4c827731316581ce598e
openssl095a-0.9.5a-18.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0c8458c5fe99f2dccbd99fc1471e579d
 
Red Hat Linux 7.2

SRPMS:
openssl-0.9.6b-30.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 3ae2cc393a411ce6d4bf02ca2902c3b3
openssl095a-0.9.5a-18.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 4eeca68ad45a889cf99e9888244f811f
 
IA-32:
openssl-0.9.6b-30.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 561ca4b931f7aa1b5e5b187eadc50979
openssl-0.9.6b-30.7.i686.rpm
File outdated by:  RHSA-2003:291
    MD5: 90238359f766d40a6fea1ce187378e0f
openssl-devel-0.9.6b-30.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: b800915ee28c2ee3e16f0efd3a982cfd
openssl-perl-0.9.6b-30.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 61343012eef3bbe98c0d84a507d42139
openssl095a-0.9.5a-18.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0c8458c5fe99f2dccbd99fc1471e579d
openssl096-0.9.6-13.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: f1f521a9af06532b0ca4cbadf191f9f6
 
IA-64:
openssl-0.9.6b-30.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: d04117405d4d98952b45482b540adc48
openssl-devel-0.9.6b-30.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: 835873daf75483628c41030b2d3bf416
openssl-perl-0.9.6b-30.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: 4bfc8f05437a13ceb5fbcad25e7a4a50
openssl095a-0.9.5a-18.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: 6405dbbcc5bb5bf240b4623456b4d6ab
openssl096-0.9.6-13.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: cca8bf123ae09e0c73b9a817b441af1b
 
Red Hat Linux 7.3

SRPMS:
openssl-0.9.6b-30.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 3ae2cc393a411ce6d4bf02ca2902c3b3
openssl095a-0.9.5a-18.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 4eeca68ad45a889cf99e9888244f811f
 
IA-32:
openssl-0.9.6b-30.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 561ca4b931f7aa1b5e5b187eadc50979
openssl-0.9.6b-30.7.i686.rpm
File outdated by:  RHSA-2003:291
    MD5: 90238359f766d40a6fea1ce187378e0f
openssl-devel-0.9.6b-30.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: b800915ee28c2ee3e16f0efd3a982cfd
openssl-perl-0.9.6b-30.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 61343012eef3bbe98c0d84a507d42139
openssl095a-0.9.5a-18.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0c8458c5fe99f2dccbd99fc1471e579d
openssl096-0.9.6-13.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: f1f521a9af06532b0ca4cbadf191f9f6
 
Red Hat Linux 8.0

SRPMS:
openssl-0.9.6b-31.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 280a5beecb76fe4f7a00a745cbc03737
openssl095a-0.9.5a-19.src.rpm
File outdated by:  RHSA-2003:291
    MD5: bd2e48a63222cde53b86b00acf368a1e
openssl096-0.9.6-14.src.rpm
File outdated by:  RHSA-2003:291
    MD5: c9103cd84c301e53c7c79f4e349b43fc
 
IA-32:
openssl-0.9.6b-31.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: aaffbdfe037fdfc0a3a45cea4e3fe7d9
openssl-0.9.6b-31.i686.rpm
File outdated by:  RHSA-2003:291
    MD5: 12f5cab2bde7ac88bbb311aeba04bd9e
openssl-devel-0.9.6b-31.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0a1a647afb7dea3de6bbac9603f3d45b
openssl-perl-0.9.6b-31.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 41c0188d93babf72ffa3dc88b42cc3a7
openssl095a-0.9.5a-19.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 276c04536cfa314afa3154fb9ee58582
openssl096-0.9.6-14.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 8db8722990b478451e8fcb04aa14da2a
 

References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/