Attachment 16952 Details for Bug 51657

sec-int discussion

openssl-missing-fix.txt (text/plain), 7.12 KB, created by Thomas Biege on 2004-03-22 17:15:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-03-22 17:15:54 UTC

Size: 7.12 KB

patch

obsolete

>From beej@alum.mit.edu Mon Mar 22 09:17:11 2004
>Date: Wed, 17 Mar 2004 17:27:18 -0400
>From: Marc Bejarano <beej@alum.mit.edu>
>To: bugtraq@securityfocus.com
>Cc: secnotice@fedoralegacy.org, security@suse.de, Mark J Cox <mark@awe.com>
>Subject: [security@suse.de] Re: New OpenSSL releases fix denial of service
>    attacks [17 March 2004]
>
>At 13:52 3/17/2004, Marc Bejarano wrote:
>>At 11:30 3/17/2004, Mark J Cox wrote:
>> >> according to NISCC Vulnerability Advisory 224012 (
>> >> http://www.uniras.gov.uk/vuls/2004/224012/index.htm ), there is also a
>> >> third potential DoS that was found with this testing sweep: CVE
>> >> CAN-2004-0081.  quoting from the NISCC advisory:
>> >
>> >Absolutely, but that was fixed back in 0.9.6d a long time ago.
>>
>>there appears to be a new CVE number corresponding to this issue.  that 
>>either means that 1) the issue is really new to CVE and most people 
>>weren't aware of it and should be made so, regardless of whether a fix was 
>>slipped in long ago or 2) the CVE number is a dupe and should be marked as 
>>such.
>>
>>do you know which case we have?
>
>mark cox replied in personal email that we have the former case.  the issue 
>is new to CVE.  though the bug was fixed in 0.9.6d, the security 
>implications of the bug were unknown at the time so it wasn't 
>publicized.  hopefully, things will go better this time.
>
>it doesn't look good, though.  cisco's is the only vendor advisory i've 
>seen so far that mentions CAN-2004-0081.  the suse advisory 
>SuSE-SA:2004:007 makes no mention of the issue and says that 
>openssl-0.9.6c-87.i386.rpm is available for suse 8.0.  it's probably 
>missing this fix :(  there are lots of older redhat machines out there with 
>older openssl software, too.  eg, the latest rpm for openssl for redhat 7.3 
>is openssl-0.9.6b-35.7.  hopefully the fine folks at fedoralegacy.org will 
>get around to a fix.
>
>marc 
>
>From jkeating@j2solutions.net Mon Mar 22 09:17:35 2004
>Date: Wed, 17 Mar 2004 14:33:15 -0800
>From: Jesse Keating <jkeating@j2solutions.net>
>To: Marc Bejarano <beej@alum.mit.edu>, bugtraq@securityfocus.com
>Cc: secnotice@fedoralegacy.org, security@suse.de, Mark J Cox <mark@awe.com>
>Subject: [security@suse.de] Re: New OpenSSL releases fix denial of service
>    attacks [17 March 2004]
>
>On Wednesday 17 March 2004 13:27, Marc Bejarano wrote:
>> mark cox replied in personal email that we have the former case.  the
>> issue is new to CVE.  though the bug was fixed in 0.9.6d, the
>> security implications of the bug were unknown at the time so it
>> wasn't publicized.  hopefully, things will go better this time.
>>
>> it doesn't look good, though.  cisco's is the only vendor advisory
>> i've seen so far that mentions CAN-2004-0081.  the suse advisory
>> SuSE-SA:2004:007 makes no mention of the issue and says that
>> openssl-0.9.6c-87.i386.rpm is available for suse 8.0.  it's probably
>> missing this fix :(  there are lots of older redhat machines out
>> there with older openssl software, too.  eg, the latest rpm for
>> openssl for redhat 7.3 is openssl-0.9.6b-35.7.  hopefully the fine
>> folks at fedoralegacy.org will get around to a fix.
>
>I'll take a look at this.  I wasn't aware that the older openssl 
>releases were vulnerable.  Seems to be a very simple one line fix.  
>I'll roll these out soon.
>
>-- 
>Jesse Keating RHCE      (geek.j2solutions.net)
>Fedora Legacy Team      (www.fedoralegacy.org)
>GPG Public Key          (geek.j2solutions.net/jkeating.j2solutions.pub)
> 
>Was I helpful?  Let others know:
> http://svcs.affero.net/rm.php?r=jkeating
>
>    [ Part 2, "signature"  Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>
>
>From mark@awe.com Mon Mar 22 09:18:10 2004
>Date: Wed, 17 Mar 2004 22:41:50 +0000 (GMT)
>From: Mark J Cox <mark@awe.com>
>To: Jesse Keating <jkeating@j2solutions.net>
>Cc: Marc Bejarano <beej@alum.mit.edu>, security@suse.de,
>    secnotice@fedoralegacy.org
>Subject: [security@suse.de] Re: New OpenSSL releases fix denial of service
>    attacks [17 March 2004]
>
>> I'll take a look at this.  I wasn't aware that the older openssl 
>> releases were vulnerable.  Seems to be a very simple one line fix.  
>> I'll roll these out soon.
>
>Attached official ones, plus           see 
>http://cvs.openssl.org/chngview?cn=5721 for the patch for CAN-2004-0081.
>
>Mark
>--
>Mark J Cox ........................................... www.awe.com/mark
>Apache Software Foundation ..... OpenSSL Group ..... Apache Week editor
>
>
>    [ Part 2, ""  Text/PLAIN (Name: "CAN-2004-0079.patch")  11 lines. ]
>    [ Unable to print this part. ]
>
>
>    [ Part 3, ""  Text/PLAIN (Name: "CAN-2004-0112.patch")  16 lines. ]
>    [ Unable to print this part. ]
>
>
>From jkeating@j2solutions.net Mon Mar 22 09:18:36 2004
>Date: Wed, 17 Mar 2004 14:45:45 -0800
>From: Jesse Keating <jkeating@j2solutions.net>
>To: Mark J Cox <mark@awe.com>
>Cc: Marc Bejarano <beej@alum.mit.edu>, security@suse.de,
>    secnotice@fedoralegacy.org
>Subject: [security@suse.de] Re: New OpenSSL releases fix denial of service
>    attacks [17 March 2004]
>
>On Wednesday 17 March 2004 14:41, Mark J Cox wrote:
>> Attached official ones, plus           see
>> http://cvs.openssl.org/chngview?cn=5721 for the patch for
>> CAN-2004-0081.
>
>Correct me if I'm wrong, but 0.9.6b isn't listed as vuln in 
>CAN-2004-0079, nor CAN-2004-0112.  That is unless Red Hat backported 
>the vulnerable code from newer Openssl releases.  Perhaps I'm mistaken, 
>I haven't taken the time yet to review the source code (still at work).
>
>-- 
>Jesse Keating RHCE      (geek.j2solutions.net)
>Fedora Legacy Team      (www.fedoralegacy.org)
>GPG Public Key          (geek.j2solutions.net/jkeating.j2solutions.pub)
> 
>Was I helpful?  Let others know:
> http://svcs.affero.net/rm.php?r=jkeating
>
>    [ Part 2, "signature"  Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>
>
>From jkeating@j2solutions.net Mon Mar 22 09:18:57 2004
>Date: Wed, 17 Mar 2004 14:48:17 -0800
>From: Jesse Keating <jkeating@j2solutions.net>
>To: Marc Bejarano <beej@alum.mit.edu>, bugtraq@securityfocus.com
>Cc: secnotice@fedoralegacy.org, security@suse.de, Mark J Cox <mark@awe.com>
>Subject: [security@suse.de] Re: New OpenSSL releases fix denial of service
>    attacks [17 March 2004]
>
>On Wednesday 17 March 2004 13:27, Marc Bejarano wrote:
>> it doesn't look good, though.  cisco's is the only vendor advisory
>> i've seen so far that mentions CAN-2004-0081.  the suse advisory
>> SuSE-SA:2004:007 makes no mention of the issue and says that
>> openssl-0.9.6c-87.i386.rpm is available for suse 8.0.  it's probably
>> missing this fix :(  there are lots of older redhat machines out
>> there with older openssl software, too.  eg, the latest rpm for
>> openssl for redhat 7.3 is openssl-0.9.6b-35.7.  hopefully the fine
>> folks at fedoralegacy.org will get around to a fix.
>
>Red Hat's RHSA-2004:121-01 for RHL 9 includes mention and fix of 
>CAN-2004-0081.  Seems that 0081 is the only thing that previous 
>releases of RHL are effected by.
>
>-- 
>Jesse Keating RHCE      (geek.j2solutions.net)
>Fedora Legacy Team      (www.fedoralegacy.org)
>GPG Public Key          (geek.j2solutions.net/jkeating.j2solutions.pub)
> 
>Was I helpful?  Let others know:
> http://svcs.affero.net/rm.php?r=jkeating
>
>    [ Part 2, "signature"  Application/PGP-SIGNATURE  196bytes. ]
>    [ Unable to print this part. ]
>

Actions: View

Attachments on bug 51657: 16952 | 16958 | 16959 | 17040 | 17048 | 17049