Red Hat ENTERPRISE LINUX 5.5 - S 2010, Manual

Page: 207 / 470

openssl
197
As well, these updated packages add the following enhancement:
* A call to RAND_cleanup() has been added to ssh and sshd to clean the PRNG status when exiting
the program. This enhancement also ensures FIPS-140-2 compliance. (
BZ#557164
1629
)
All openssh users should upgrade to these updated packages, which resolve these issues.
1.145. openssl
1.145.1. RHSA-2010:0162: Important security update
Important
This update has already been released (prior to the GA of this release) as the security
errata
RHSA-2010:0162
1630
Updated openssl packages that fix several security issues are now available for Red Hat Enterprise
Linux 5.
The Red Hat Security Response Team has rated this update as having important security impact.
Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are
available for each vulnerability from the CVE links in the References section.
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols, as well as a full-strength, general purpose cryptography library.
It was discovered that OpenSSL did not always check the return value of the bn_wexpand() function.
An attacker able to trigger a memory allocation failure in that function could cause an application using
the OpenSSL library to crash or, possibly, execute arbitrary code. (
CVE-2009-3245
1631
)
A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure Sockets Layer) protocols
handled session renegotiation. A man-in-the-middle attacker could use this flaw to prefix arbitrary
plain text to a client's session (for example, an HTTPS connection to a website). This could force the
server to process an attacker's request as if authenticated using the victim's credentials. This update
addresses this flaw by implementing the TLS Renegotiation Indication Extension, as defined in RFC
5746. (
CVE-2009-3555
1632
)
Refer to the following Knowledgebase article for additional details about the
CVE-2009-3555
1633
flaw:
http://kbase.redhat.com/faq/docs/DOC-20491
A missing return value check flaw was discovered in OpenSSL, that could possibly cause OpenSSL to
call a Kerberos library function with invalid arguments, resulting in a NULL pointer dereference crash
in the MIT Kerberos library. In certain configurations, a remote attacker could use this flaw to crash
a TLS/SSL server using OpenSSL by requesting Kerberos cipher suites during the TLS handshake.
(
CVE-2010-0433
1634
)
1629
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=557164
1631
https://www.redhat.com/security/data/cve/CVE-2009-3245.html
1632
https://www.redhat.com/security/data/cve/CVE-2009-3555.html
1633
https://www.redhat.com/security/data/cve/CVE-2009-3555.html
1634
https://www.redhat.com/security/data/cve/CVE-2010-0433.html