Test ID:	1.3.6.1.4.1.25623.1.0.51409
Category:	Conectiva Local Security Checks
Title:	Conectiva Security Advisory CLA-2003:625
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory CLA-2003:625. OpenSSL[1] implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as full-strength general purpose cryptography functions. It is used (as a library) by several projects, like Apache, OpenSSH, Bind, OpenLDAP and many others clients and servers programs. This OpenSSL update addresses the issues outlined below: 1) Klima-Pokorny-Rosa attack (CVE-2003-0131)[2][3] Vlastimil Klima, Ondrej Pokorny and Tomas Rosa published[6] a paper where they present an extension to the Bleichenbacher attack on RSA with PKCS #1 v1.5 padding as used in SSL 3.0 and TLS 1.0. This vulnerability would allow a remote attacker to perform a single RSA private key operation on a ciphertext of his/her choice using the server's RSA key after analysing the server's behaviour with a large number of specially crafted connections. 2) Timing attack (CAN 2003-147)[4][5] D. Boneh and D. Brumley published[7] a paper in which they demonstrate that remote timing attacks are possible and practical against OpenSSL and derived libraries. They successfully extracted private keys from a webserver in a local network. In order to prevent such attacks, a technique known as RSA blinding has been turned on by default in OpenSSL. Additionally, some smaller fixes from newer versions of OpenSSL have been included in the packages provided via this update. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' https://secure1.securityspace.com/smysecure/catid.html?in=CLA-2003:625 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002003 Risk factor : High CVSS Score: 7.5
Cross-Ref:	BugTraq ID: 7148 Common Vulnerability Exposure (CVE) ID: CVE-2003-0131 http://www.securityfocus.com/bid/7148 Bugtraq: 20030319 [OpenSSL Advisory] Klima-Pokorny-Rosa attack on PKCS #1 v1.5 padding (Google Search) http://marc.info/?l=bugtraq&m=104811162730834&w=2 Bugtraq: 20030324 GLSA: openssl (200303-20) (Google Search) http://marc.info/?l=bugtraq&m=104852637112330&w=2 Bugtraq: 20030327 Immunix Secured OS 7+ openssl update (Google Search) http://www.securityfocus.com/archive/1/316577/30/25310/threaded Caldera Security Advisory: CSSA-2003-014.0 ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-014.0.txt CERT/CC vulnerability note: VU#888801 http://www.kb.cert.org/vuls/id/888801 Conectiva Linux advisory: CLA-2003:625 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000625 Debian Security Information: DSA-288 (Google Search) http://www.debian.org/security/2003/dsa-288 En Garde Linux Advisory: ESA-20030320-010 FreeBSD Security Advisory: FreeBSD-SA-03:06 http://www.gentoo.org/security/en/glsa/glsa-200303-20.xml Immunix Linux Advisory: IMNX-2003-7+-001-01 http://www.mandriva.com/security/advisories?name=MDKSA-2003:035 http://eprint.iacr.org/2003/052/ http://www.linuxsecurity.com/advisories/immunix_advisory-3066.html NETBSD Security Advisory: NetBSD-SA2003-007 ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2003-007.txt.asc http://www.openpkg.org/security/OpenPKG-SA-2003.026-openssl.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A461 http://www.redhat.com/support/errata/RHSA-2003-101.html http://www.redhat.com/support/errata/RHSA-2003-102.html SGI Security Advisory: 20030501-01-I ftp://patches.sgi.com/support/free/security/advisories/20030501-01-I SuSE Security Announcement: SuSE-SA:2003:024 (Google Search) https://lists.opensuse.org/opensuse-security-announce/2003-04/msg00005.html http://marc.info/?l=bugtraq&m=104878215721135&w=2 XForce ISS Database: ssl-premaster-information-leak(11586) https://exchange.xforce.ibmcloud.com/vulnerabilities/11586
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.