Synopsis

openssl096b security update

Type/Severity

Security Advisory: Moderate

Topic

Updated OpenSSL096b compatibility packages that fix a remote denial of
service vulnerability are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

The OpenSSL toolkit implements Secure Sockets Layer (SSL v2/v3),
Transport Layer Security (TLS v1) protocols, and serves as a full-strength
general purpose cryptography library. OpenSSL 0.9.6b libraries are provided
for Red Hat Enterprise Linux 3 and 4 to allow compatibility with legacy
applications.

Testing performed by the OpenSSL group using the Codenomicon TLS Test Tool
uncovered a null-pointer assignment in the do_change_cipher_spec()
function. A remote attacker could perform a carefully crafted SSL/TLS
handshake against a server that uses the OpenSSL library in such a way as
to cause OpenSSL to crash. Depending on the server this could lead to a
denial of service. (CVE-2004-0079)

This issue was reported as not affecting OpenSSL versions prior to 0.9.6c,
and testing with the Codenomicon Test Tool showed that OpenSSL 0.9.6b as
shipped as a compatibility library with Red Hat Enterprise Linux 3 and 4
did not crash. However, an alternative reproducer has been written which
shows that this issue does affect versions of OpenSSL prior to 0.9.6c.

Note that Red Hat does not ship any applications with Red Hat Enterprise
Linux 3 or 4 that use these compatibility libraries.

Users of the OpenSSL096b compatibility package are advised to upgrade to
these updated packages, which contain a patch provided by the OpenSSL group
that protect against this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 172094 - CVE-2004-0079 OpenSSL remote DoS

CVEs

• CVE-2004-0079

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
openssl096b-0.9.6b-22.42.src.rpm	SHA-256: 5e55132ea8e59565cb72206a29d234598779a944b8aeac82ea510fad09611094
x86_64
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.x86_64.rpm	SHA-256: b988d0af5c08281c084f4378fa7892a314f36fd102278470541a964ca5891331
openssl096b-0.9.6b-22.42.x86_64.rpm	SHA-256: b988d0af5c08281c084f4378fa7892a314f36fd102278470541a964ca5891331
ia64
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.ia64.rpm	SHA-256: 857e0c9bd411ff8e9dfb112e32dabd0e9552cf2b244bd41cb3b53ff0709b6518
openssl096b-0.9.6b-22.42.ia64.rpm	SHA-256: 857e0c9bd411ff8e9dfb112e32dabd0e9552cf2b244bd41cb3b53ff0709b6518
i386
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c

Red Hat Enterprise Linux Workstation 4

SRPM
openssl096b-0.9.6b-22.42.src.rpm	SHA-256: 5e55132ea8e59565cb72206a29d234598779a944b8aeac82ea510fad09611094
x86_64
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.x86_64.rpm	SHA-256: b988d0af5c08281c084f4378fa7892a314f36fd102278470541a964ca5891331
ia64
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.ia64.rpm	SHA-256: 857e0c9bd411ff8e9dfb112e32dabd0e9552cf2b244bd41cb3b53ff0709b6518
i386
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c

Red Hat Enterprise Linux Desktop 4

SRPM
openssl096b-0.9.6b-22.42.src.rpm	SHA-256: 5e55132ea8e59565cb72206a29d234598779a944b8aeac82ea510fad09611094
x86_64
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c
openssl096b-0.9.6b-22.42.x86_64.rpm	SHA-256: b988d0af5c08281c084f4378fa7892a314f36fd102278470541a964ca5891331
i386
openssl096b-0.9.6b-22.42.i386.rpm	SHA-256: a8484b6b14398b3267af457693341d61953023e34336238ed528c47520fb174c

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
openssl096b-0.9.6b-22.42.src.rpm	SHA-256: 5e55132ea8e59565cb72206a29d234598779a944b8aeac82ea510fad09611094
s390x
openssl096b-0.9.6b-22.42.s390.rpm	SHA-256: c1f8a68d8d071be721c03ab988b00518487f76a6dc022a4b166b62b2604b2550
s390
openssl096b-0.9.6b-22.42.s390.rpm	SHA-256: c1f8a68d8d071be721c03ab988b00518487f76a6dc022a4b166b62b2604b2550

Red Hat Enterprise Linux for Power, big endian 4

SRPM
openssl096b-0.9.6b-22.42.src.rpm	SHA-256: 5e55132ea8e59565cb72206a29d234598779a944b8aeac82ea510fad09611094
ppc
openssl096b-0.9.6b-22.42.ppc.rpm	SHA-256: 919fe51f2339a6deb583468e0080b56dc2283d7805d68d0ae5a702c4602cce3e