GLSA 200912-01: OpenSSL Multiple Vulnerabilities Fix (CVE-2009-3555/MD2/DTLS)

Vulnerability Information Announcement ID: GLSA 200912-01 Release Date: December 1, 2009 Latest Revision: December 2, 2009 Affected Package: dev-libs/openssl - Affected Versions: = 0.9.8l-r2 Severity: normal Exploitability: remote Background OpenSSL is an open-source toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols, and also serves as a general-purpose cryptography library. Description Multiple vulnerabilities have been reported in OpenSSL: Improper handling of session renegotiation requests in the TLS protocol (CVE-2009-3555). The MD2 hash algorithm is no longer considered cryptographically strong enough; certificates using this algorithm will no longer be accepted (CVE-2009-2409). Vulnerabilities in DTLS: use-after-free error (CVE-2009-1379), null pointer dereference error (CVE-2009-1387), multiple memory leaks in src/d1_both.c (CVE-2009-1378), and handling errors related to a large number of future DTLS records in ssl/d1_pkt.c (CVE-2009-1377). Impact A remote, unauthenticated attacker could inject arbitrary plaintext into a TLS session, potentially allowing them to send requests as if authenticated as the victim. Remote attackers could send specially crafted DTLS packets to services using OpenSSL for DTLS support, potentially causing a denial of service. Additionally, remote attackers may be able to create forged certificates aided by MD2 collisions. Note: The computational effort required for such an attack remains substantial. Solution All OpenSSL users should upgrade to the latest version: References CVE-2009-1377 CVE-2009-1378 CVE-2009-1379 CVE-2009-1387 CVE-2009-2409 CVE-2009-3555

Goal Reached Thanks to every supporter — we hit 100%!

GLSA 200912-01: OpenSSL Multiple Vulnerabilities Fix (CVE-2009-3555/MD2/DTLS)