NetBSD Security Advisory 2004-005
		 =================================

Topic:		Denial of service vulnerabilities in OpenSSL

Version:	NetBSD-current:	source prior to March 22, 2004
		NetBSD 2.0:	branch unaffected, release will include the fix
		NetBSD 1.6.2:	affected
		NetBSD 1.6.1:	affected
		NetBSD 1.6:	affected
		NetBSD 1.5.3:	affected
		NetBSD 1.5.2:	affected
		NetBSD 1.5.1:	affected
		NetBSD 1.5:	affected
		pkgsrc:		security/openssl packages prior to 0.9.6m

Severity:	Possible denial of service, depending on the application

Fixed:		NetBSD-current:		March 22, 2004
		NetBSD-1.6 branch:	April  2, 2004
					(1.6.3 will include the fix)
		NetBSD-1.5 branch:	April  7, 2004
		pkgsrc:			openssl-0.9.6m corrects this issue


Abstract
========

There are two distinct denial of service vulnerabilities addressed by this
advisory:

	1. Null-pointer assignment during SSL handshake

	A carefully crafted SSL/TLS handshake against a server which
	uses the OpenSSL library may result in a crash.  Depending on how
	the application uses the OpenSSL library, this may result in a
	denial of service.


	2. Out-of-bounds read affects Kerberos ciphersuites

	A second flaw in the SSL/TLS handshake could cause a server
	configured to use the Kerberos ciphersuites to crash if a carefully
	crafted sequence of packets is sent by an attacker.



Solutions and Workarounds
=========================

The following instructions describe how to upgrade your libcrypto and libssl
libraries by updating your source tree and rebuilding and
installing a new versions.

* NetBSD-current:

	Systems running NetBSD-current dated from before 2004-03-22
	should be upgraded to NetBSD-current dated 2004-03-23 or later.

	The following directories need to be updated from the
	netbsd-current CVS branch (aka HEAD):
		crypto/dist/openssl

	To update from CVS, re-build, and re-install libcrypto and libssl
		# cd src
		# cvs update -d -P crypto/dist/openssl

		# cd lib/libcrypto
		# make cleandir dependall
		# make install
		# cd ../../lib/libssl
		
		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install


* NetBSD 1.6, 1.6.1, 1.6.2:

	The binary distribution of NetBSD 1.6, 1.6.1 and 1.6.2 are vulnerable.

	Systems running NetBSD 1.6 sources dated from before
	2004-04-02 should be upgraded from NetBSD 1.6 sources dated
	2004-04-03 or later.

	NetBSD 1.6.3 will include the fix.

	The following directories need to be updated from the
	netbsd-1-6 CVS branch:
		crypto/dist/openssl

	To update from CVS, re-build, and re-install libcrypto and libssl

		# cd src
		# cvs update -d -P -r netbsd-1-6 crypto/dist/openssl

		# cd lib/libcrypto
		# make cleandir dependall
		# make install
		# cd ../../lib/libssl

		# make USETOOLS=no cleandir dependall
		# make USETOOLS=no install

* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

	The binary distribution of NetBSD 1.5 to 1.5.3 are vulnerable.   

	Systems running NetBSD 1.5, 1.5.1, 1.5.2, or 1.5.3 sources dated
	from before 2004-04-07 should be upgraded from NetBSD 1.5.*
	sources dated 2004-04-08 or later.

	The following directories need to be updated from the
	netbsd-1-5 CVS branch:
		crypto/dist/openssl

	To update from CVS, re-build, and re-install libcrypto and libssl

		# cd src
		# cvs update -d -P -r netbsd-1-5 crypto/dist/openssl

		# cd lib/libcrypto
		# make cleandir dependall
		# make install
		# cd ../../lib/libssl

		# make cleandir dependall
		# make install

Revision History
================

	2004-04-21	Initial release


More Information
================

Advisories may be updated as new information becomes available.
The most recent version of this advisory (PGP signed) can be found at 
   ftp://ftp.NetBSD.org/pub/NetBSD/security/advisories/NetBSD-SA2004-005.txt.asc

Information about NetBSD and NetBSD security can be found at 
http://www.NetBSD.org/ and  http://www.NetBSD.org/Security/.


Copyright 2004, The NetBSD Foundation, Inc.  All Rights Reserved.
Redistribution permitted only in full, unmodified form.

$NetBSD: NetBSD-SA2004-005.txt,v 1.3 2004/04/21 17:34:50 david Exp $