Multiple SSL/TLS implementation CBC ciphersuites information leak

ssl-cbc-information-leak (11369) The risk level is classified as MediumMedium Risk

Description:

OpenSSL could allow a remote attacker to obtain sensitive information using a timing attack on CBC (Cipher Block Chaining) ciphersuites. If multiple active SSL or TLS connections use a fixed plaintext block, an attacker with access to the encrypted traffic stream could replace legitimate SSL/TLS ciphertext blocks with modified ciphertext blocks, and possibly distinguish between block cipher padding errors and MAC verification errors by measuring the amount of time it takes to receive a response. This information could then be used by the attacker to obtain a complete plaintext block.


Consequences:

Obtain Information

Remedy:

Upgrade to the latest version of Sun JSSE, SDK, or JRE, as listed below. Refer to Sun Alert ID: 56380 for more information. See References.

JSSE in SDK and JRE: 1.4.1_03 or later
JSSE: 1.0.3_02 or later

For OpenSSL:
Upgrade to the latest version of OpenSSL (0.9.6i or later) or (0.9.7a or later), as listed in OpenSSL Security Advisory [19 February 2003]. See References.

—OR—

Apply the patch for this vulnerability, as listed in OpenSSL Security Advisory [19 February 2003]. See References.

For GNU TLS:
Upgrade to the latest version of GNU TLS (0.8.3 or later), availabel from the GNU TLS Web page. See References.

For OpenPKG:
Upgrade to the latest openssl package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2003.013 for more information. See References.

OpenPKG CURRENT: 0.9.7a-20030219 or later
OpenPKG 1.2: 0.9.7-1.2.1 or later
OpenPKG 1.1: 0.9.6g-1.1.1 or later

For EnGarde Secure Linux Community Edition:
Upgrade to the latest openssl package (0.9.6-1.0.18 or later), as listed in EnGarde Secure Linux Security Advisory 20030220-005. See References.

For Gentoo Linux:
Upgrade to the latest version of dev-libs/openssl (openssl-0.9.6i or later or openssl-0.9.7a or later), as listed in Gentoo Linux Security Announcement 200302-10. See References.

For Mandrake Linux:
Upgrade to the latest openssl package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2003:020 : openssl for more information. See References.

Mandrake Linux 7.2: 0.9.5a-9.mdk or later
Mandrake Linux 8.0: 0.9.6i-1.1mdk or later
Mandrake Linux 8.1, 8.2, 9.0 and Multi Network Firewall 8.2: 0.9.6i-1.2mdk or later
Mandrake Linux 9.0: 0.9.6i-1.2mdk or later
Single Network Firewall 7.2: 0.9.5a-9.4mdk or later

For Trustix Secure Linux 1.5, 1.2 and 1.1:
Upgrade to the latest OpenSSL package (0.9.6-12tr or later), as listed in Trustix Secure Linux Security Advisory #2003-0005. See References.

For Debian GNU/Linux:
Upgrade to the latest openssl package, as listed below. Refer to DSA-253-1 for more information. See References.

Debian GNU/Linux 2.2 (potato): 0.9.6c-0.potato.5 or later
Debian GNU/Linux 3.0 (woody): 0.9.6c-2.woody.2 or later

For Conectiva Linux:
Upgrade to the latest openssl package, as listed below. Refer to Conectiva Linux Announcement CLSA-2003:570 for more information. See References.

Conectiva Linux 6.0: 0.9.6-4U60_5cl or later
Conectiva Linux 7.0: 0.9.6a-3U70_5cl or later
Conectiva Linux 8.0: 0.9.6c-2U80_4cl or later

For FreeBSD:
Upgrade to the latest version of FreeBSD (FreeBSD 4-STABLE or the latest security branch dated later than 2003-02-20), as listed in FreeBSD Security Advisory FreeBSD-SA-03:02.openssl. See References.

—OR—

Apply the appropriate patch for your system, as listed in FreeBSD Security Advisory FreeBSD-SA-03:02.openssl. See References.

For SuSE Linux:
Upgrade to the latest openssl package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2003:0011 for more information. See References.

SuSE Linux 8.1 (Intel): 0.9.6g-55 or later
SuSE Linux 8.0 (Intel): 0.9.6c-83 or later
SuSE Linux 7.3 (Intel): 0.9.6b-154 or later
SuSE Linux 7.2 and 7.1 (Intel): 0.9.6a-78 or later
SuSE Linux 7.3 (Sparc): 0.9.6b-87 or later
SuSE Linux 7.3 (PPC): 0.9.6b-147 or later
SuSE Linux 7.1 (PPC): 0.9.6a-28 or later

For NetBSD-current:
Upgrade to the latest version of NetBSD-current (dated 2003-02-21 or later), as listed in NetBSD Security Advisory 2003-001. See References.

For NetBSD 1.6:
Upgrade to the latest version of NetBSD 1.6 (dated 2003-02-21 or later), as listed in NetBSD Security Advisory 2003-001. See References.

For NetBSD 1.5, 1.5.1, 1.5.2, and 1.5.3:
Upgrade to the latest version of the NetBSD 1.5 branch (dated 2003-02-27 or later), as listed in NetBSD Security Advisory 2003-001. See References.

For Apple Mac OS X 10.2.4 and earlier:
Apply the Mac OS X Server Update 10.2.4, as listed in AppleCare Knowledge Base Document 120195. See References.

For Red Hat Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to RHSA-2003:062-11 for more information. See References.

Red Hat 6.2: openssl-0.9.5a-30 or later
Red Hat 7.0, 7.1, 7.2, and 7.3: openssl095a-0.9.5a-18.7 or later
Red Hat 8.0: openssl095a-0.9.5a-19 or later

Apply the appropriate patch for your system, as listed in FreeBSD Security Advisory FreeBSD-SA-03:02.openssl. See References.

For Sun ONE Web Server 6.0 SP1 through SP5:
Apply the Sun ONE Web Server 6.0 Service Pack 6 later, as listed in the Sun Alert ID: 54147.

For Sun ONE Appliation Server 7.0:
Apply the Sun ONE Application Server 7.0 Update Release 1 or later, as listed in the Sun Alert ID: 54147.

For HP-UX 11.00, 11.11, 11.22, and 11.23:
Upgrade to the version of Java with the security fix, as listed in Hewlett-Packard Company Security BulletinHPSBUX0303-248. See References.

For Oracle9i Database and Application Server, Oracle8i Database Server and Oracle HTTP Server:
Apply the appropriate patch for your system, as listed in Oracle Security Alert #62. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

References:

Platforms Affected:

  • Conectiva Linux 6.0
  • Conectiva Linux 7.0
  • Conectiva Linux 8.0
  • Debian Debian Linux 2.2
  • Debian Debian Linux 3.0
  • EngardeLinux Secure Linux
  • FreeBSD FreeBSD 4.0
  • FreeBSD FreeBSD 4.1
  • FreeBSD FreeBSD 4.1.1
  • FreeBSD FreeBSD 4.2
  • FreeBSD FreeBSD 4.3
  • FreeBSD FreeBSD 4.4
  • FreeBSD FreeBSD 4.5
  • FreeBSD FreeBSD 4.6
  • FreeBSD FreeBSD 4.6.1
  • Gentoo Linux
  • GNU TLS 0.8.2
  • HP HP-UX 11.00
  • HP HP-UX 11.11
  • HP HP-UX 11.22
  • HP HP-UX 11.23
  • MandrakeSoft Mandrake Linux 7.2
  • MandrakeSoft Mandrake Linux 8.0
  • MandrakeSoft Mandrake Linux 8.0 PPC
  • MandrakeSoft Mandrake Linux 8.1
  • MandrakeSoft Mandrake Linux 8.1 IA64
  • MandrakeSoft Mandrake Linux 8.2
  • MandrakeSoft Mandrake Linux 8.2 PPC
  • MandrakeSoft Mandrake Linux 9.0
  • MandrakeSoft Mandrake Multi Network Firewall 8.2
  • MandrakeSoft Mandrake Single Network Firewall 7.2
  • NetBSD NetBSD 1.5
  • NetBSD NetBSD 1.5.1
  • NetBSD NetBSD 1.5.2
  • NetBSD NetBSD 1.5.3
  • NetBSD NetBSD 1.6
  • NetBSD NetBSD CURRENT
  • Novell SuSE Linux Enterprise Server 7.0
  • OpenPKG OpenPKG 1.1
  • OpenPKG OpenPKG 1.2
  • OpenPKG OpenPKG CURRENT
  • OpenSSL OpenSSL 0.9.1c
  • OpenSSL OpenSSL 0.9.2b
  • OpenSSL OpenSSL 0.9.3
  • OpenSSL OpenSSL 0.9.3a
  • OpenSSL OpenSSL 0.9.4
  • OpenSSL OpenSSL 0.9.5
  • OpenSSL OpenSSL 0.9.5 Beta2
  • OpenSSL OpenSSL 0.9.5 Beta1
  • OpenSSL OpenSSL 0.9.5a Beta1
  • OpenSSL OpenSSL 0.9.5a
  • OpenSSL OpenSSL 0.9.5a Beta2
  • OpenSSL OpenSSL 0.9.6
  • OpenSSL OpenSSL 0.9.6 Beta1
  • OpenSSL OpenSSL 0.9.6 Beta2
  • OpenSSL OpenSSL 0.9.6 Beta3
  • OpenSSL OpenSSL 0.9.6a Beta1
  • OpenSSL OpenSSL 0.9.6a
  • OpenSSL OpenSSL 0.9.6a Beta3
  • OpenSSL OpenSSL 0.9.6a Beta2
  • OpenSSL OpenSSL 0.9.6b
  • OpenSSL OpenSSL 0.9.6c
  • OpenSSL OpenSSL 0.9.6d
  • OpenSSL OpenSSL 0.9.6e
  • OpenSSL OpenSSL 0.9.6f
  • OpenSSL OpenSSL 0.9.6g
  • OpenSSL OpenSSL 0.9.6h
  • OpenSSL OpenSSL 0.9.6i
  • OpenSSL OpenSSL 0.9.6j
  • OpenSSL OpenSSL 0.9.6k
  • OpenSSL OpenSSL 0.9.6l
  • OpenSSL OpenSSL 0.9.6m
  • OpenSSL OpenSSL 0.9.7
  • OpenSSL OpenSSL 0.9.7 Beta6
  • OpenSSL OpenSSL 0.9.7 Beta5
  • OpenSSL OpenSSL 0.9.7 Beta4
  • OpenSSL OpenSSL 0.9.7 Beta3
  • OpenSSL OpenSSL 0.9.7 Beta2
  • OpenSSL OpenSSL 0.9.7 Beta1
  • OpenSSL OpenSSL 0.9.7a
  • OpenSSL OpenSSL 0.9.7b
  • OpenSSL OpenSSL 0.9.7c
  • OpenSSL OpenSSL 0.9.7d
  • Oracle Application Server 1.0.2.1s
  • Oracle Application Server 1.0.2.2
  • Oracle Application Server 9.0.2
  • Oracle Application Server 9.0.3
  • Oracle Database Server 8.1.7
  • Oracle Database Server 9.0.1 R1
  • Oracle Database Server 9.2.0 R2
  • Oracle HTTP Server 8.1.7
  • Oracle HTTP Server 9.0.1
  • Oracle HTTP Server 9.2
  • RedHat Enterprise Linux 2.1 ES
  • RedHat Enterprise Linux 2.1 WS
  • RedHat Enterprise Linux 2.1 AS
  • RedHat Linux 6.2
  • RedHat Linux 7
  • RedHat Linux 7.1
  • RedHat Linux 7.1 for iSeries
  • RedHat Linux 7.1 for pSeries
  • RedHat Linux 7.2
  • RedHat Linux 7.3
  • RedHat Linux 8.0
  • RedHat Linux Advanced Workstation 2.1 Itanium
  • Sun JSSE 1.0.3
  • Sun JSSE 1.0.3_01
  • Sun JSSE 1.0.3_02
  • Sun JSSE 1.0.3_03
  • Sun JSSE 1.4.0
  • Sun JSSE 1.4.0_01
  • Sun JSSE 1.4.0_02
  • Sun JSSE 1.4.0_03
  • Sun JSSE 1.4.0_04
  • Sun JSSE 1.4.1
  • Sun JSSE 1.4.1_01
  • Sun JSSE 1.4.1_02
  • Sun ONE Application Server 7.0
  • Sun ONE Web Server 6.0 SP2
  • Sun ONE Web Server 6.0 SP1
  • Sun ONE Web Server 6.0 SP4
  • Sun ONE Web Server 6.0 SP5
  • Sun ONE Web Server 6.0 SP3
  • SuSE Linux Enterprise Server 8
  • SuSE SuSE eMail Server 3.1
  • SuSE SuSE eMail Server III
  • SUSE SuSE Linux 7.1
  • SUSE SuSE Linux 7.2
  • SUSE SuSE Linux 7.3
  • SUSE SuSE Linux 8.0
  • SUSE SuSE Linux 8.1
  • SuSE SuSE Linux Connectivity Server
  • SuSE SuSE Linux Database Server
  • SuSE SuSE Linux Firewall
  • SuSE SuSE Linux Office Server
  • Trustix Secure Linux 1.1
  • Trustix Secure Linux 1.2
  • Trustix Secure Linux 1.5
  • Turbolinux Turbolinux 7 Server
  • Turbolinux Turbolinux 7 Workstation
  • Turbolinux Turbolinux 8 Server
  • Turbolinux Turbolinux 8 Workstation
  • Turbolinux Turbolinux Advanced Server 6
  • Turbolinux Turbolinux Server 6.1
  • Turbolinux Turbolinux Server 6.5
  • Turbolinux Turbolinux Workstation 6.0

Reported:

Feb 19, 2003

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email ignore thisxforceignore this@ignore thisus.ignore thisibm.comignore this

Return to the main page