MGASA-2016-0093

Dashboard / Vulnerabilities / MGASA-2016-0093

MGASA-2016-0093

Summary: Updated openssl packages fix security vulnerabilities

Details: Update openssl packages fix security vulnerabilities: Yuval Yarom from the University of Adelaide and NICTA, Daniel Genkin from Technion and Tel Aviv University, and Nadia Heninger from the University of Pennsylvania discovered a side-channel attack which makes use of cache-bank conflicts on the Intel Sandy-Bridge microarchitecture. This could allow local attackers to recover RSA private keys (CVE-2016-0702). Adam Langley from Google discovered a double free bug when parsing malformed DSA private keys. This could allow remote attackers to cause a denial of service or memory corruption in applications parsing DSA private keys received from untrusted sources (CVE-2016-0705). Guido Vranken discovered an integer overflow in the BN_hex2bn and BN_dec2bn functions that can lead to a NULL pointer dereference and heap corruption. This could allow remote attackers to cause a denial of service or memory corruption in applications processing hex or dec data received from untrusted sources (CVE-2016-0797). Emilia Käsper of the OpenSSL development team discovered a memory leak in the SRP database lookup code. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to the SRP_VBASE_get1_by_user function (CVE-2016-0798). Guido Vranken discovered an integer overflow in the BIO_*printf functions that could lead to an OOB read when printing very long strings. Additionally the internal doapr_outch function can attempt to write to an arbitrary memory location in the event of a memory allocation failure. These issues will only occur on platforms where sizeof(size_t) > sizeof(int) like many 64 bit systems. This could allow remote attackers to cause a denial of service or memory corruption in applications that pass large amounts of untrusted data to the BIO_*printf functions (CVE-2016-0799). Note that Mageia is not vulnerable to the DROWN issue, also known as CVE-2016-0800, in its default configuration, as SSLv2 was disabled by default in Mageia 5. However, upstream mitigations for DROWN have also been incorporated into this update, protecting systems that may have enabled it.

References: https://advisories.mageia.org/MGASA-2016-0093.html, https://bugs.mageia.org/show_bug.cgi?id=17859, http://openssl.org/news/secadv/20160301.txt, https://www.debian.org/security/2016/dsa-3500