-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org openpkg-securityat_private openpkgat_private OpenPKG-SA-2003.019 18-Mar-2003 ________________________________________________________________________ Package: openssl Vulnerability: local and remote extraction of RSA private key OpenPKG Specific: no Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT <= openssl-0.9.7a-20030219 >= openssl-0.9.7a-20030317 OpenPKG 1.2 <= openssl-0.9.7-1.2.1 >= openssl-0.9.7-1.2.2 OpenPKG 1.1 <= openssl-0.9.6g-1.1.1 >= openssl-0.9.6g-1.1.2 Affected Releases: Dependent Packages: OpenPKG CURRENT apache cadaver cpu curl dsniff easysoap ethereal exim fetchmail imap imapd inn linc links lynx mico mixmaster mozilla mutt nail neon openldap openvpn perl-ssl postfix postgresql qpopper samba sendmail siege sio sitecopy socat stunnel subversion sysmon w3m wget OpenPKG 1.2 apache cpu curl ethereal fetchmail imap inn links lynx mico mutt nail neon openldap perl-ssl postfix postgresql qpopper samba sendmail siege sitecopy socat stunnel sysmon w3m wget OpenPKG 1.1 apache curl fetchmail inn links lynx mutt neon openldap perl-ssl postfix postgresql qpopper samba siege sitecopy socat stunnel sysmon w3m Description: David Brumley and Dan Boneh of Stanford University have researched and documented a timing attack on OpenSSL which allows local and remote attackers to extract the RSA private key of a server. [0] The OpenSSL [1] RSA implementation is generally vulnerable to these type of attacks unless RSA blinding has been turned on [2]. Typically, RSA blinding is not enabled by OpenSSL based applications, mainly because it is not obvious how to do so when using OpenSSL to provide SSL/TLS. This problem affects mostly all applications using OpenSSL and have to be rebuilded against the fixed OpenSSL version (where RSA blinding is now enabled by default) or have to enable RSA blinding explicitly their own. The performance impact of RSA blinding appears to be small (a few percent only) and the RSA functionality is still fully compatible. The Common Vulnerabilities and Exposures (CVE) project assigned the id CAN-2003-0147 [3] to the problem. Please check whether you are affected by running "<prefix>/bin/rpm -q openssl". If you have the "openssl" package installed and its version is affected (see above), we recommend that you immediately upgrade it (see Solution) and it's dependent packages (see above), if any, too. [4][5] Solution: Select the updated source RPM appropriate for your OpenPKG release [6][7], fetch it from the OpenPKG FTP service [8][9] or a mirror location, verify its integrity [10], build a corresponding binary RPM from it [4] and update your OpenPKG installation by applying the binary RPM [5]. For the current release OpenPKG 1.2, perform the following operations to permanently fix the security problem (for other releases adjust accordingly). $ ftp ftp.openpkg.org ftp> bin ftp> cd release/1.2/UPD ftp> get openssl-0.9.7-1.2.2.src.rpm ftp> bye $ <prefix>/bin/rpm -v --checksig openssl-0.9.7-1.2.2.src.rpm $ <prefix>/bin/rpm --rebuild openssl-0.9.7-1.2.2.src.rpm $ su - # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/openssl-0.9.7-1.2.2.*.rpm Additionally, you have to rebuild and reinstall all dependent packages (see above), too. [4][5] ________________________________________________________________________ References: [0] http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf [1] http://www.openssl.org/ [2] http://www.openssl.org/news/secadv_20030317.txt [3] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0147 [4] http://www.openpkg.org/tutorial.html#regular-source [5] http://www.openpkg.org/tutorial.html#regular-binary [6] ftp://ftp.openpkg.org/release/1.1/UPD/openssl-0.9.6g-1.1.2.src.rpm [7] ftp://ftp.openpkg.org/release/1.2/UPD/openssl-0.9.7-1.2.2.src.rpm [8] ftp://ftp.openpkg.org/release/1.1/UPD/ [9] ftp://ftp.openpkg.org/release/1.2/UPD/ [10] http://www.openpkg.org/security.html#signature ________________________________________________________________________ For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG <openpkgat_private>" (ID 63C4CB9F) of the OpenPKG project which you can find under the official URL http://www.openpkg.org/openpkg.pgp or on http://keyserver.pgp.com/. To check the integrity of this advisory, verify its digital signature by using GnuPG (http://www.gnupg.org/). For instance, pipe this message to the command "gpg --verify --keyserver keyserver.pgp.com". ________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Comment: OpenPKG <openpkgat_private> iD8DBQE+dvGTgHWT4GPEy58RAlXaAJ90QOgj+C9+Lwe7NLu/FTt8e2XV8ACfZfyf C3hwua723fCPNbHTCyi5Zcw= =hEKo -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Tue Mar 18 2003 - 16:22:09 PST