- Issued:
- 2012-09-24
- Updated:
- 2012-09-24
RHSA-2012:1308 - Security Advisory
Synopsis
Important: openssl security update
Type/Severity
Security Advisory: Important
Topic
An update for the OpenSSL component for JBoss Enterprise Application
Platform 6.0.0 for Solaris and Microsoft Windows that fixes multiple
security issues is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Description
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.
Multiple numeric conversion errors, leading to a buffer overflow, were
found in the way OpenSSL parsed ASN.1 (Abstract Syntax Notation One) data
from BIO (OpenSSL's I/O abstraction) inputs. Specially-crafted DER
(Distinguished Encoding Rules) encoded data read from a file or other BIO
input could cause an application using the OpenSSL library to crash or,
potentially, execute arbitrary code. (CVE-2012-2110)
A double free flaw was discovered in the policy checking code in OpenSSL.
A remote attacker could use this flaw to crash an application that uses
OpenSSL by providing an X.509 certificate that has specially-crafted
policy extension data. (CVE-2011-4109)
An information leak flaw was found in the SSL 3.0 protocol implementation
in OpenSSL. Incorrect initialization of SSL record padding bytes could
cause an SSL client or server to send a limited amount of possibly
sensitive data to its SSL peer via the encrypted connection.
(CVE-2011-4576)
It was discovered that OpenSSL did not limit the number of TLS/SSL
handshake restarts required to support Server Gated Cryptography. A remote
attacker could use this flaw to make a TLS/SSL server using OpenSSL consume
an excessive amount of CPU by continuously restarting the handshake.
(CVE-2011-4619)
This update also fixes additional security issues in OpenSSL that are not
exposed in JBoss Enterprise Application Platform: CVE-2011-4108,
CVE-2012-0884, CVE-2012-1165, and CVE-2012-2333.
Warning: Before applying this update, back up your existing JBoss
Enterprise Application Platform installation and deployed applications, and
also back up your existing Apache HTTP Server installation (including all
applications and configuration files).
All users of JBoss Enterprise Application Platform 6.0.0 for Solaris and
Microsoft Windows as provided from the Red Hat Customer Portal are advised
to apply this update.
Solution
The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing JBoss Enterprise Application Platform installation and deployed
applications, and also back up your existing Apache HTTP Server
installation (including all applications and configuration files).
The Apache HTTP Server, as well as JBoss server instances configured to use
the Tomcat Native library, must be restarted for this update to take
effect.
Affected Products
- JBoss Enterprise Application Platform Text-Only Advisories x86_64
Fixes
- BZ - 771770 - CVE-2011-4108 openssl: DTLS plaintext recovery attack
- BZ - 771771 - CVE-2011-4109 openssl: double-free in policy checks
- BZ - 771775 - CVE-2011-4576 openssl: uninitialized SSL 3.0 padding
- BZ - 771780 - CVE-2011-4619 openssl: SGC restart DoS attack
- BZ - 802489 - CVE-2012-1165 openssl: mime_param_cmp NULL dereference crash
- BZ - 802725 - CVE-2012-0884 openssl: CMS and PKCS#7 Bleichenbacher attack
- BZ - 814185 - CVE-2012-2110 openssl: asn1_d2i_read_bio integer errors leading to buffer overflow
- BZ - 820686 - CVE-2012-2333 openssl: record length handling integer underflow
CVEs
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
