MGASA-2014-0255

Dashboard / Vulnerabilities / MGASA-2014-0255

MGASA-2014-0255

Summary: Updated openssl packages fix multiple vulnerabilties

Details: Updated openssl packages fix security vulnerabilities: It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. (CVE-2014-0224) Note: In order to exploit this flaw, both the server and the client must be using a vulnerable version of OpenSSL; the server must be using OpenSSL version 1.0.1 and above, and the client must be using any version of OpenSSL. For more information about this flaw, refer to RedHat article 904433 in the references. All currently supported versions of Mageia are running OpenSSL 1.0.1. A buffer overflow flaw was found in the way OpenSSL handled invalid DTLS packet fragments. A remote attacker could possibly use this flaw to execute arbitrary code on a DTLS client or server. (CVE-2014-0195) A denial of service flaw was found in the way OpenSSL handled certain DTLS ServerHello requests. A specially crafted DTLS handshake packet could cause a DTLS client using OpenSSL to crash. (CVE-2014-0221) A NULL pointer dereference flaw was found in the way OpenSSL performed anonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A specially crafted handshake packet could cause a TLS/SSL client that has the anonymous ECDH cipher suite enabled to crash. (CVE-2014-3470)

References: https://advisories.mageia.org/MGASA-2014-0255.html, https://www.openssl.org/news/secadv_20140605.txt, https://access.redhat.com/site/articles/904433, https://rhn.redhat.com/errata/RHSA-2014-0625.html, https://bugs.mageia.org/show_bug.cgi?id=13484