MESSAGE
| DATE | 2003-03-06 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [hangout] rhn-admin@rhn.redhat.com: RHN Errata Alert: Updated OpenSSL packages fix timing attack
|
Date: Thu, 6 Mar 2003 18:01:35 -0500
Subject: RHN Errata Alert: Updated OpenSSL packages fix timing attack
X-RHN-Info: Autogenerated mail for rubensafir
X-RHN-Email:
Precedence: first-class
Errors-To: rhn-bounce+1726851-2286000-at-rhn.redhat.com
From: Red Hat Network Alert
To: rubensafir
X-RHN-Login: rubensafir
Red Hat Network has determined that the following advisory is applicable to
one or more of the systems you have registered:
Complete information about this errata can be found at the following location:
https://rhn.redhat.com/network/errata/errata_details.pxt?eid=1513
Security Advisory - RHSA-2003:062-11
------------------------------------------------------------------------------
Summary:
Updated OpenSSL packages fix timing attack
Updated OpenSSL packages are available that fix a potential timing-based
attack.
Description:
OpenSSL is a commercial-grade, full-featured, and open source toolkit that
implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer
Security (TLS v1) protocols as well as a full-strength general purpose
cryptography library.
In a paper, Brice Canvel, Alain Hiltgen, Serge Vaudenay, and Martin
Vuagnoux describe and demonstrate a timing-based attack on CBC ciphersuites
in SSL and TLS. An active attacker may be able to use timing observations
to distinguish between two different error cases: cipher padding errors and
MAC verification errors. Over multiple connections this can leak
sufficient information to make it possible to retrieve the plaintext of a
common, fixed block.
In order for an attack to be sucessful, an attacker must be able to act as
a man-in-the-middle to intercept and modify multiple connections, which all
involve a common fixed plaintext block (such as a password), and have good
network conditions that allow small changes in timing to be reliably
observed.
These erratum packages contain a patch provided by the OpenSSL group that
corrects this vulnerability.
Because server applications are affected by these vulnerabilities, we
advise users to restart all services that use OpenSSL functionality or
alternatively reboot their systems after installing these updates.
References:
http://lasecwww.epfl.ch/pub/lasec/doc/Vau02a.ps
------------------------------------------------------------------------------
-------------
Taking Action
-------------
You may address the issues outlined in this advisory in two ways:
- select your server name by clicking on its name from the list
available at the following location, and then schedule an
errata update for it:
https://rhn.redhat.com/network/systemlist/system_list.pxt
- run the Update Agent on each affected server.
---------------------------------
Changing Notification Preferences
---------------------------------
To enable/disable your Errata Alert preferences globally please log in to RHN
and navigate from "Your RHN" / "Your Account" to the "Preferences" tab.
URL: https://rhn.redhat.com/network/my_account/my_prefs.pxt
You can also enable/disable notification on a per system basis by selecting an
individual system from the "Systems List". From the individual system view
click the "Details" tab.
----------------
Affected Systems
----------------
According to our records, this errata may apply to one or more of the
systems that you've profiled with Red Hat Network. To see precisely which
systems are affected, please go to:
https://rhn.redhat.com/network/errata/systems_affected.pxt?eid=1513
The Red Hat Network Team
This message is being sent by Red Hat Network Alert to:
RHN user login: rubensafir
Email address on file:
If you lost your RHN password, you can use the information above to
retrieve it by email from the following address:
https://rhn.redhat.com/forgot_password.pxt
To cancel these notices, go to:
https://rhn.redhat.com/oo.pxt?uid=1726851&oid=2286000
----- End forwarded message -----
--
__________________________
Brooklyn Linux Solutions
__________________________
DRM is THEFT - We are the STAKEHOLDERS http://fairuse.nylxs.com
http://www.mrbrklyn.com - Consulting
http://www.inns.net <-- Happy Clients
http://www.nylxs.com - Leadership Development in Free Software
http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and articles from around the net
http://www2.mrbrklyn.com/downtown.html - See the New Downtown Brooklyn....
1-718-382-0585
____________________________
NYLXS: New Yorker Free Software Users Scene
Fair Use -
because it's either fair use or useless....
NYLXS is a trademark of NYLXS, Inc
|
|
