FreeBSD安全公告
来源:互联网 发布:淘宝买家信誉是怎么升 编辑:程序博客网 时间:2024/04/30 02:06
FreeBSD-SA-07:08.openssl
发表: delphij-----BEGIN PGP SIGNED MESSAGE-----
时间: 2007/10/04 06:01:27
Hash: SHA1
=============================================================================
FreeBSD-SA-07:08.openssl Security Advisory
The FreeBSD Project
Topic: Buffer overflow in OpenSSL SSL_get_shared_ciphers()
Category: contrib
Module: openssl
Announced: 2007-10-03
Credits: Moritz Jodeit
Affects: All FreeBSD releases.
Corrected: 2007-10-03 21:39:43 UTC (RELENG_6, 6.2-STABLE)
2007-10-03 21:40:35 UTC (RELENG_6_2, 6.2-RELEASE-p8)
2007-10-03 21:41:22 UTC (RELENG_6_1, 6.1-RELEASE-p20)
2007-10-03 21:42:00 UTC (RELENG_5, 5.5-STABLE)
2007-10-03 21:42:32 UTC (RELENG_5_5, 5.5-RELEASE-p16)
CVE Name: CVE-2007-5135
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:http://security.FreeBSD.org/>.
I. Background
FreeBSD includes software from the OpenSSL Project. The OpenSSL Project is
a collaborative effort to develop a robust, commercial-grade, full-featured,
and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols as well as a full-strength
general purpose cryptography library.
II. Problem Description
A buffer overflow addressed in FreeBSD-SA-06:23.openssl has been found
to be incorrectly fixed.
III. Impact
For applications using the SSL_get_shared_ciphers() function, the
buffer overflow could allow an attacker to crash or potentially
execute arbitrary code with the permissions of the user running the
application.
IV. Workaround
No workaround is available, but only applications using the
SSL_get_shared_ciphers() function are affected.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to 5-STABLE, or 6-STABLE, or to the
RELENG_6_2, RELENG_6_1, or RELENG_5_5 security branch dated after the
correction date.
2) To patch your present system:
The following patch have been verified to apply to FreeBSD 5.5, 6.1,
and 6.2 systems.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch http://security.FreeBSD.org/patches/SA-07:08/openssl.patch # fetch http://security.FreeBSD.org/patches/SA-07:08/openssl.patch.asc
b) Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/secure/lib/libssl
# make obj && make depend && make && make install
VI. Correction details
The following list contains the revision numbers of each file that was
corrected in FreeBSD.
Branch Revision
Path
- -------------------------------------------------------------------------
RELENG_5
src/crypto/openssl/ssl/ssl_lib.c 1.1.1.11.2.3
RELENG_5_5
src/UPDATING 1.342.2.35.2.16
src/sys/conf/newvers.sh 1.62.2.21.2.18
src/crypto/openssl/ssl/ssl_lib.c 1.1.1.11.2.1.4.2
RELENG_6
src/crypto/openssl/ssl/ssl_lib.c 1.1.1.12.2.2
RELENG_6_2
src/UPDATING 1.416.2.29.2.11
src/sys/conf/newvers.sh 1.69.2.13.2.11
src/crypto/openssl/ssl/ssl_lib.c 1.1.1.12.2.1.2.1
RELENG_6_1
src/UPDATING 1.416.2.22.2.22
src/sys/conf/newvers.sh 1.69.2.11.2.22
src/crypto/openssl/ssl/ssl_lib.c 1.1.1.12.6.2
- -------------------------------------------------------------------------
VII. References
http://marc.info/?l=bugtraq&m=119091888624735 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3738 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5135
The latest revision of this advisory is available at
http://security.FreeBSD.org/advisories/FreeBSD-SA-07:08.openssl.asc -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (FreeBSD)
iD8DBQFHBA+HFdaIBMps37IRAtTQAJ0bFBZt7DVJzhQkUcu7VdNS7Kj8cwCeMQaS
cNFjW3j2eolZhlee83l3blo=
=zwC2
-----END PGP SIGNATURE-----
- FreeBSD安全公告
- 微软十月安全公告
- 让FreeBSD更安全
- 让FreeBSD更安全
- freebsd 内核安全
- FreeBSD安全配置小结
- 让FreeBSD更安全
- [FreeBSD] 安全加固
- 让FreeBSD更安全(Securing FreeBSD)
- Bamboo-重要安全建议公告
- FreeBSD服务的安全配置
- OpenSSH安全(from FreeBSD 使用手册)
- 微软安全公告:三个高危补丁
- 微软安全公告MS06-042更新
- 卡巴斯基还在其安全公告中指出
- 微软安全公告 MS02-061 (MS,补丁)
- FreeBSD下构建安全的Web服务器
- FreeBSD下构建安全的Web服务器
- SQL SERVER中关于NULL应注意的问题
- SQL的一些用法小结
- 代码片段: javascript 的slider
- 呼叫中心后台管理系统
- ERP常用词汇中英文对照
- FreeBSD安全公告
- 嫦娥一号发射直播,嫦娥一号发射视频
- 要塞:十字军东征中文版 修改器
- 软件测试模型的使用
- 嫦娥一号一分钟倒记时及发射瞬间
- 三分之一上市公司披露三季报绩优股数量增加
- 转php面试题及我的答案(六)
- 1
- VS2003 安装部署1