OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Ralf S. Engelschall
Root: /e/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-web Date: 18-Mar-2003 11:15:27
Branch: HEAD Handle: 2003031810152600
Modified files:
openpkg-web/security OpenPKG-SA-2003.019-openssl.txt
Log:
final polishing, bugfixing and signing
Summary:
Revision Changes Path
1.3 +29 -15 openpkg-web/security/OpenPKG-SA-2003.019-openssl.txt
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-web/security/OpenPKG-SA-2003.019-openssl.txt
============================================================================
$ cvs diff -u -r1.2 -r1.3 OpenPKG-SA-2003.019-openssl.txt
--- openpkg-web/security/OpenPKG-SA-2003.019-openssl.txt 18 Mar 2003 10:04:16
-0000 1.2
+++ openpkg-web/security/OpenPKG-SA-2003.019-openssl.txt 18 Mar 2003 10:15:26
-0000 1.3
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project
@@ -7,7 +10,7 @@
________________________________________________________________________
Package: openssl
-Vulnerability: timing attack
+Vulnerability: local and remote extraction of RSA private key
OpenPKG Specific: no
Affected Releases: Affected Packages: Corrected Packages:
@@ -34,16 +37,20 @@
siege sitecopy socat stunnel sysmon w3m
Description:
- David Brumley and Dan Boneh of Stanford University have researched and
- documented a timing attack on RSA private keys. [0] The OpenSSL [1]
- RSA implementation is generally vulnerable to these type of attacks
- unless RSA blinding has been turned on [2]. Typically, RSA blinding
- is not enabled by OpenSSL based applications, mainly because it is
- not obvious how to do so when using OpenSSL to provide SSL/TLS. This
- problem affects mostly all applications using OpenSSL and have to be
- rebuilded against the fixed OpenSSL version (where RSA blinding is now
- enabled by default) or have to enable RSA blinding explicitly their
- own. The performance impact of RSA blinding appears to be small (a few
+ David Brumley and Dan Boneh of Stanford University have researched
+ and documented a timing attack on OpenSSL which allows local and
+ remote attackers to extract the RSA private key of a server. [0] The
+ OpenSSL [1] RSA implementation is generally vulnerable to these type
+ of attacks unless RSA blinding has been turned on [2].
+
+ Typically, RSA blinding is not enabled by OpenSSL based applications,
+ mainly because it is not obvious how to do so when using OpenSSL to
+ provide SSL/TLS. This problem affects mostly all applications using
+ OpenSSL and have to be rebuilded against the fixed OpenSSL version
+ (where RSA blinding is now enabled by default) or have to enable RSA
+ blinding explicitly their own.
+
+ The performance impact of RSA blinding appears to be small (a few
percent only) and the RSA functionality is still fully compatible. The
Common Vulnerabilities and Exposures (CVE) project assigned the id
CAN-2003-0147 [3] to the problem.
@@ -66,12 +73,12 @@
$ ftp ftp.openpkg.org
ftp> bin
ftp> cd release/1.2/UPD
- ftp> get openssl-0.9.7-1.2.1.src.rpm
+ ftp> get openssl-0.9.7-1.2.2.src.rpm
ftp> bye
- $ <prefix>/bin/rpm -v --checksig openssl-0.9.7-1.2.1.src.rpm
- $ <prefix>/bin/rpm --rebuild openssl-0.9.7-1.2.1.src.rpm
+ $ <prefix>/bin/rpm -v --checksig openssl-0.9.7-1.2.2.src.rpm
+ $ <prefix>/bin/rpm --rebuild openssl-0.9.7-1.2.2.src.rpm
$ su -
- # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/openssl-0.9.7-1.2.1.*.rpm
+ # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/openssl-0.9.7-1.2.2.*.rpm
Additionally, you have to rebuild and reinstall all dependent
packages (see above), too. [4][5]
@@ -100,3 +107,10 @@
the command "gpg --verify --keyserver keyserver.pgp.com".
________________________________________________________________________
+-----BEGIN PGP SIGNATURE-----
+Comment: OpenPKG <[EMAIL PROTECTED]>
+
+iD8DBQE+dvGTgHWT4GPEy58RAlXaAJ90QOgj+C9+Lwe7NLu/FTt8e2XV8ACfZfyf
+C3hwua723fCPNbHTCyi5Zcw=
+=hEKo
+-----END PGP SIGNATURE-----
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List [EMAIL PROTECTED]
