LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 27th, 2014
Linux Advisory Watch: October 24th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Slackware: openssl Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Slackware New openssl packages are available for Slackware 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues. More details about these issues may be found in the Common Vulnerabilities and Exposures (CVE) database: CVE-2006-2937 CVE-2006-3738 CVE-2006-2940 CVE-2006-4343
[slackware-security]  openssl (SSA:2006-272-01)

New openssl packages are available for Slackware 9.0, 9.1, 10.0, 10.1,
10.2, and -current to fix security issues.

More details about these issues may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343

Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/openssl-0.9.7l-i486-1_slack10.2.tgz:
  Upgraded to shared libraries from openssl-0.9.7l.
  See openssl package update below.
  (* Security fix *)
patches/packages/openssl-0.9.7l-i486-1_slack10.2.tgz:
  Upgraded to openssl-0.9.7l.
  This fixes a few security related issues:
      During the parsing of certain invalid ASN.1 structures an error
    condition is mishandled.  This can result in an infinite loop which
    consumes system memory (CVE-2006-2937).  (This issue did not affect
    OpenSSL versions prior to 0.9.7)
    Thanks to Dr S. N. Henson of Open Network Security and NISCC.
      Certain types of public key can take disproportionate amounts of
    time to process. This could be used by an attacker in a denial of
    service attack (CVE-2006-2940).
    Thanks to Dr S. N. Henson of Open Network Security and NISCC.
      A buffer overflow was discovered in the SSL_get_shared_ciphers()
    utility function.  An attacker could send a list of ciphers to an
    application that uses this function and overrun a buffer.
    (CVE-2006-3738)
    Thanks to Tavis Ormandy and Will Drewry of the Google Security Team.
      A flaw in the SSLv2 client code was discovered. When a client
    application used OpenSSL to create an SSLv2 connection to a malicious
    server, that server could cause the client to crash (CVE-2006-4343).
    Thanks to Tavis Ormandy and Will Drewry of the Google Security Team.
  Links to the CVE entries will be found here:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2937
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2940
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4343
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

HINT:  Getting slow download speeds from ftp.slackware.com?
Give slackware.osuosl.org a try.  This is another primary FTP site
for Slackware that can be considerably faster than downloading
from ftp.slackware.com.

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating additional FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 9.0:
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-solibs-0.9.7l-i386-1_slack9.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/openssl-0.9.7l-i386-1_slack9.0.tgz

Updated packages for Slackware 9.1:
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-solibs-0.9.7l-i486-1_slack9.1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/openssl-0.9.7l-i486-1_slack9.1.tgz

Updated packages for Slackware 10.0:
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/openssl-solibs-0.9.7l-i486-1_slack10.0.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/openssl-0.9.7l-i486-1_slack10.0.tgz

Updated packages for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/openssl-solibs-0.9.7l-i486-1_slack10.1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/openssl-0.9.7l-i486-1_slack10.1.tgz

Updated packages for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/openssl-solibs-0.9.7l-i486-1_slack10.2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/openssl-0.9.7l-i486-1_slack10.2.tgz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-0.9.8d-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-0.9.8d-i486-1.tgz


MD5 signatures:
+-------------+

Slackware 9.0 packages:
3b17c8be79ca99cb16321d2675f2885d  openssl-0.9.7l-i386-1_slack9.0.tgz
a7cb86681f01b57f7bff49842b393a67  openssl-solibs-0.9.7l-i386-1_slack9.0.tgz

Slackware 9.1 packages:
f222c26925ce542a25a93df674e8106c  openssl-0.9.7l-i486-1_slack9.1.tgz
fca221391f0b591373b6e38f1d732d63  openssl-solibs-0.9.7l-i486-1_slack9.1.tgz

Slackware 10.0 packages:
a1013cef56210154a2259c5135f1d047  openssl-0.9.7l-i486-1_slack10.0.tgz
35c40208e50ca4bcd7e7e16ce5db1526  openssl-solibs-0.9.7l-i486-1_slack10.0.tgz

Slackware 10.1 packages:
6c87f5baca8855cd07031824b747fe80  openssl-0.9.7l-i486-1_slack10.1.tgz
3ae63bd5b7178f880e8ed5a3af602b50  openssl-solibs-0.9.7l-i486-1_slack10.1.tgz

Slackware 10.2 packages:
a97c874a4bf6dc4ca6a4617966108a45  openssl-0.9.7l-i486-1_slack10.2.tgz
06b462fad82d28af4fba3f35f2ed25a1  openssl-solibs-0.9.7l-i486-1_slack10.2.tgz

Slackware -current package:
88264ebbe45eb908c2d3f3f32c367cf6  openssl-solibs-0.9.8d-i486-1.tgz
9f9d2d98fefd5cbd9334cfa374934efa  openssl-0.9.8d-i486-1.tgz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg openssl-solibs-0.9.7l-i486-1_slack10.2.tgz openssl-0.9.7l-i486-1_slack10.2.tgz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Pirate Bay founder guilty in historic hacker case
Parallels CTO: Linux container security is not the problem
Advisory says to assume all Drupal 7 websites are compromised
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.