Skip to navigation

Security Advisory Updated OpenSSL packages fix vulnerabilities

Advisory: RHSA-2003:101-15
Type: Security Advisory
Severity: N/A
Issued on: 2003-04-01
Last updated on: 2003-04-01
Affected Products: Red Hat Linux 6.2
Red Hat Linux 7.0
Red Hat Linux 7.1
Red Hat Linux 7.2
Red Hat Linux 7.3
Red Hat Linux 8.0
Red Hat Linux 9
CVEs (cve.mitre.org): CVE-2003-0131
CVE-2003-0147

Details

Updated OpenSSL packages are available that fix a potential timing-based
attack and a modified Bleichenbacher attack.

OpenSSL is a commercial-grade, full-featured, and open source toolkit that
implements Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols as well as a full-strength general purpose
cryptography library.

Researchers discovered a timing attack on RSA keys. Applications making
use of OpenSSL are generally vulnerable to such an attack, unless RSA
blinding has been turned on. OpenSSL does not use RSA blinding by default
and most applications do not enable RSA blinding.

A local or remote attacker could use this attack to obtain the server's
private key by determining factors using timing differences on (1) the
number of extra reductions during Montgomery reduction, and (2) the use of
different integer multiplication algorithms ("Karatsuba" and normal).

In order for an attack to be sucessful, an attacker must have good
network conditions that allow small changes in timing to be reliably
observed.

Additionally, the SSL and TLS components for OpenSSL allow remote attackers
to perform an unauthorized RSA private key operation via a modified
Bleichenbacher attack. This attack uses a large number of SSL or TLS
connections, using PKCS #1 v1.5 padding, and causes OpenSSL to leak
information regarding the relationship between ciphertext and the
associated plaintext, aka the "Klima-Pokorny-Rosa attack."

These erratum packages contain a patch provided by the OpenSSL group that
enables RSA blinding by default and protects against the
"Klima-Pokorny-Rosa attack."

Because server applications are affected by these vulnerabilities, users
are advised to restart all services that use OpenSSL functionality or
reboot their systems after installing these updates.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Updated packages

Red Hat Linux 6.2

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/openssl/0.9.5a-33/SRPMS/openssl-0.9.5a-33.src.rpm
Missing file
    MD5: 5b18dd23c08f698d4190a8ece2b3167f
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/openssl/0.9.5a-33/i386/openssl-0.9.5a-33.i386.rpm
Missing file
    MD5: 4603bdefd96d82d175b093b30614e02b
ftp://updates.redhat.com/rhn/repository/NULL/openssl-devel/0.9.5a-33/i386/openssl-devel-0.9.5a-33.i386.rpm
Missing file
    MD5: da36dafc17769e729618550c0cb0ea4a
ftp://updates.redhat.com/rhn/repository/NULL/openssl-perl/0.9.5a-33/i386/openssl-perl-0.9.5a-33.i386.rpm
Missing file
    MD5: 4dca145d74e2c19d6c61a873cdfa4f57
ftp://updates.redhat.com/rhn/repository/NULL/openssl-python/0.9.5a-33/i386/openssl-python-0.9.5a-33.i386.rpm
Missing file
    MD5: 39121ad8d81f395f1b8a78bb48add695
 
Red Hat Linux 7.0

SRPMS:
openssl-0.9.6-16.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 61a8dcc09dd6deb22873e86d5674c054
openssl095a-0.9.5a-20.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 5ca6550f8ac5068ee74ff3e8878c122d
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/openssl/0.9.6-16/i386/openssl-0.9.6-16.i386.rpm
Missing file
    MD5: 8a225b9cb704c1c8d55fdc9128d4a965
ftp://updates.redhat.com/rhn/repository/NULL/openssl-devel/0.9.6-16/i386/openssl-devel-0.9.6-16.i386.rpm
Missing file
    MD5: 166f2a495bfdd5b9dec82872bbc2a0d1
ftp://updates.redhat.com/rhn/repository/NULL/openssl-perl/0.9.6-16/i386/openssl-perl-0.9.6-16.i386.rpm
Missing file
    MD5: 249846dd8034d0923643f1e296683353
ftp://updates.redhat.com/rhn/repository/NULL/openssl-python/0.9.6-16/i386/openssl-python-0.9.6-16.i386.rpm
Missing file
    MD5: 7031de82572cf6dcd68b33273dea1c82
ftp://updates.redhat.com/rhn/repository/NULL/openssl095a/0.9.5a-20.7/i386/openssl095a-0.9.5a-20.7.i386.rpm
Missing file
    MD5: 0dba680affa927eceb890f7ea2ca5347
 
Red Hat Linux 7.1

SRPMS:
openssl-0.9.6-16.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 61a8dcc09dd6deb22873e86d5674c054
openssl095a-0.9.5a-20.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 5ca6550f8ac5068ee74ff3e8878c122d
 
IA-32:
openssl-0.9.6-16.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 8a225b9cb704c1c8d55fdc9128d4a965
openssl-devel-0.9.6-16.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 166f2a495bfdd5b9dec82872bbc2a0d1
openssl-perl-0.9.6-16.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 249846dd8034d0923643f1e296683353
openssl-python-0.9.6-16.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 7031de82572cf6dcd68b33273dea1c82
openssl095a-0.9.5a-20.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0dba680affa927eceb890f7ea2ca5347
 
Red Hat Linux 7.2

SRPMS:
openssl-0.9.6b-32.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: e998276b64905803ab43e52fa96f89dd
openssl095a-0.9.5a-20.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 5ca6550f8ac5068ee74ff3e8878c122d
openssl096-0.9.6-16.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 5a0236175fcd6141bad13103e69d84d7
 
IA-32:
openssl-0.9.6b-32.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 8a9f793cc9fc713551c307072fe718d6
openssl-0.9.6b-32.7.i686.rpm
File outdated by:  RHSA-2003:291
    MD5: c68a5311f1aaa36279517de2b942f80f
openssl-devel-0.9.6b-32.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 29714991bb3d36718c2cba5c4f945c9f
openssl-perl-0.9.6b-32.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 210f404351a8b4da656b87c745d74901
openssl095a-0.9.5a-20.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0dba680affa927eceb890f7ea2ca5347
openssl096-0.9.6-16.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: b1d1807fd6f8afb2955f87fd0e1484e3
 
IA-64:
openssl-0.9.6b-32.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: 3060596923e12eb8bef8707f411aee6a
openssl-devel-0.9.6b-32.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: bc25a74463aecff055051935f7900a6b
openssl-perl-0.9.6b-32.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: ed840ac83f68fd141a09308eccdfeda6
openssl095a-0.9.5a-20.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: d87303a2d6f572eab968d783be1241df
openssl096-0.9.6-16.7.ia64.rpm
File outdated by:  RHSA-2003:291
    MD5: 925b88dbb21251467473b82610c255b3
 
Red Hat Linux 7.3

SRPMS:
openssl-0.9.6b-32.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: e998276b64905803ab43e52fa96f89dd
openssl095a-0.9.5a-20.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 5ca6550f8ac5068ee74ff3e8878c122d
openssl096-0.9.6-16.7.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 5a0236175fcd6141bad13103e69d84d7
 
IA-32:
openssl-0.9.6b-32.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 8a9f793cc9fc713551c307072fe718d6
openssl-0.9.6b-32.7.i686.rpm
File outdated by:  RHSA-2003:291
    MD5: c68a5311f1aaa36279517de2b942f80f
openssl-devel-0.9.6b-32.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 29714991bb3d36718c2cba5c4f945c9f
openssl-perl-0.9.6b-32.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 210f404351a8b4da656b87c745d74901
openssl095a-0.9.5a-20.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0dba680affa927eceb890f7ea2ca5347
openssl096-0.9.6-16.7.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: b1d1807fd6f8afb2955f87fd0e1484e3
 
Red Hat Linux 8.0

SRPMS:
openssl-0.9.6b-33.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 479d5f93a6dc28936f7e31b9f55dfe79
openssl095a-0.9.5a-21.src.rpm
File outdated by:  RHSA-2003:291
    MD5: 0b0acec1a90aeb0acef5239687bbb4c5
openssl096-0.9.6-16.8.src.rpm
File outdated by:  RHSA-2003:291
    MD5: a4706dec1418200d30f98e0093adff81
 
IA-32:
openssl-0.9.6b-33.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 4fb96db51bf3da39e5b55a647ada7954
openssl-0.9.6b-33.i686.rpm
File outdated by:  RHSA-2003:291
    MD5: 99ab9d437ab913eec09b29c8f41005a2
openssl-devel-0.9.6b-33.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: c303cbf4f81e75a7e7cb2b8e32d0505f
openssl-perl-0.9.6b-33.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 0d2212d818c0cb65a382d1f69e4d11b7
openssl095a-0.9.5a-21.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 16b70cfb654b63a11ab4b59027ebae99
openssl096-0.9.6-16.8.i386.rpm
File outdated by:  RHSA-2003:291
    MD5: 6ffaf08722105ea29f888eeacf32421a
 
Red Hat Linux 9

SRPMS:
openssl-0.9.7a-5.src.rpm
File outdated by:  RHSA-2004:121
    MD5: e30fa13f4d1365a192be91c07a3b379f
openssl096-0.9.6-17.src.rpm
File outdated by:  RHSA-2004:121
    MD5: a63d8f70a8869798b32d8cd6dd59063e
openssl096b-0.9.6b-6.src.rpm
File outdated by:  RHSA-2004:121
    MD5: 5f95500fd79d099b79a1640cb7232018
 
IA-32:
openssl-0.9.7a-5.i386.rpm
File outdated by:  RHSA-2004:121
    MD5: f4e95f889af8356a57ccc8d107b8019e
openssl-0.9.7a-5.i686.rpm
File outdated by:  RHSA-2004:121
    MD5: 2481086e38bb9cfcff10131c4311a030
openssl-devel-0.9.7a-5.i386.rpm
File outdated by:  RHSA-2004:121
    MD5: 3f7358c3cc1006be9e975c21fd01004c
openssl-perl-0.9.7a-5.i386.rpm
File outdated by:  RHSA-2004:121
    MD5: 70b2d3b41404b83c074e2057a41b9ba0
openssl096-0.9.6-17.i386.rpm
File outdated by:  RHSA-2004:121
    MD5: 4c17eeaa8a9a70021c7e119ee085c192
openssl096b-0.9.6b-6.i386.rpm
File outdated by:  RHSA-2004:121
    MD5: 6309eaac219c2c4ac1474bfcb7cbc174
 

Bugs fixed (see bugzilla for more information)

86112 - New timing attack on OpenSSL applications


References


Keywords

attack, Bleichenbacher, blinding, keys, OpenSSL, RSA


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/