OpenSSL ASN1 parser invalid encodings denial of service
| openssl-asn1-parser-dos (9718) |  Medium Risk |
Description:
OpenSSL is vulnerable to a denial of service attack, caused by a vulnerability in the ASN1 parser. A remote attacker could send invalid encoded data to any OpenSSL program that uses the ASN1 library to cause the vulnerable program or system to crash.
Consequences:
Denial of Service
Remedy:
Upgrade to the latest version of OpenSSL (0.9.6e or later), available from the OpenSSL Project Web site. See References.
— OR —
Apply the patch for this vulnerability, available from the OpenSSL Project Web site. See References.
For OpenPKG 1.0:
Upgrade to the latest OpenSSL package (0.9.6b-1.0.1 or later) or (0.9.6e or later), as listed in OpenPKG Security Advisory OpenPKG-SA-2002.008. See References.
For Debian GNU/Linux 3.0:
Upgrade to the latest OpenSSL packages (0.9.4-6 or later), (0.9.5a-6 or later), and (0.9.6c-2 or later), as listed in DSA-136-1. See References.
For EnGarde Secure Linux Community Edition: Upgrade to the latest OpenSSL package (0.9.6-1.0.17 or later), as listed in EnGarde Secure Linux Security Advisory 20020807-020. See References.
For Trustix Secure Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to Trustix Secure Linux Security Advisory #2002-0063 for more information. See References.
Trustix 1.1 and 1.2: openssl-0.9.6-3tr or later
Trustix 1.5: openssl-0.9.6-10tr
For Red Hat Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to RHSA-2002:155-11. See References.
Red Hat 6.2: openssl-0.9.5a-26 or later
Red Hat 7.0 and 7.1: openssl-0.9.6-10 or later
Red Hat 7.2 and 7.3: openssl096-0.9.6-9 or later
For SuSE Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to SuSE Security Announcement SuSE-SA:2002:027 for more information. See References.
SuSE Linux 8.0 (Intel): 0.9.6c-78 or later
SuSE Linux 7.3 (Intel): 0.9.6b-147 or later
SuSE Linux 7.1 and 7.2 (Intel): 0.9.6a-63 or later
SuSE Linux 7.0 (Intel): 0.9.5a-59 or later
SuSE Linux 7.3 (Sparc): 0.9.6b-136 or later
SuSE Linux 7.1 (Sparc): 0.9.6a-23 or later
SuSE Linux 7.0 (Sparc): 0.9.5a-8 or later
For Mandrake Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2002:046 : openssl for more information. See References.
Linux Mandrake 7.1, Corporate Server 1.0.1: 0.9.5a-4.1mdk or later
Linux Mandrake 7.2 and Single Network Firewall 7.2: 0.9.5a-9.1mdk or later
Mandrake Linux 8.0: 0.9.6-8.1mdk or later
Mandrake Linux 8.1: 0.9.6b-1.1mdk or later
Mandrake Linux 8.2: 0.9.6c-2.1mdk or later
For Caldera OpenLinux 3.1 and 3.1.1 Workstation and Server: Upgrade to the latest OpenSSL packages (0.9.6-19 or later), as listed in Caldera International, Inc. Security Advisory CSSA-2002-033.1. See References.
For FreeBSD:
Apply the patch for this vulnerability, as listed in FreeBSD, Inc. Security Advisory FreeBSD-SA-02:33.openssl. See References.
For Conectiva Linux:
Upgrade to the latest OpenSSL package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2002:516 for more information. See References.
Conectiva Linux 8.0: 0.9.6c-2U8_2cl or later
Conectiva Linux 7.0: 0.9.6a-3U70_4cl or later
Conectiva Linux 6.0: 0.9.6-4U60_4cl or later
For HP JetDirect Firmware versions X.22.00 through X.23.99:
Upgrade to the appropriate firmware version, as listed in Hewlett-Packard Company Security Bulletin HPSBUX0208-212. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Tue Jul 30 2002 - 05:15:00 CDT : OpenSSL patches for other versions .
- Caldera International, Inc. Security Advisory CSSA-2002-033.1: REVISED: multiple vulnerabilities in open.
- CERT Advisory CA-2002-23: Multiple Vulnerabilities In OpenSSL.
- CIAC Information Bulletin M-103: Multiple Vulnerabilities in OpenSSL.
- Compaq SECURITY BULLETIN SRB0036W: SSRT2310a HP Tru64 UNIX & HP OpenVMS Potential OpenSSL Security Vulnerability.
- Conectiva Linux Announcement CLSA-2002:516: openssl.
- EnGarde Secure Linux Security Advisory ESA-20020730-019: Several vulnerabilities in the openssl library. (From LinuxSecurity.com archive)
- EnGarde Secure Linux Security Advisory ESA-20020807-020: ASN.1 vulnerability fix corrections.
- FreeBSD Security Advisory FreeBSD-SA-02:33.openssl: openssl contains multiple vulnerabilities.
- OpenSSL Project Web site: OpenSSL: The Open Source toolkit for SSL/TLS.
- OpenSSL Security Advisory [30 July 2002]: Vulnerabilities in OpenSSL versions before 0.9.6e.
- Trustix Secure Linux Security Advisory #2002-0063: openssl.
- BID-5353: Multiple OpenSSL Remote Buffer Overflow Vulnerabilities
- BID-5366: OpenSSL ASN.1 Parsing Error Denial Of Service Vulnerability
- CVE-2002-0659: The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.
- DSA-136: openssl -- multiple remote exploits
- OpenPKG-SA-2002.008: OpenSSL
- RHSA-2002-160: Updated openssl packages fix protocol parsing bugs
- RHSA-2002-161: openssl security update
- US-CERT VU#748355: ASN.1 parsing errors exist in implementations of SSL, TLS, S/MIME, PKCS#7 routines
Platforms Affected:
- Debian Debian Linux 2.2
- Debian Debian Linux 3.0
- EngardeLinux Secure Linux
- EngardeLinux Secure Professional
- FreeBSD FreeBSD
- HP JetDirect
- HP OpenVMS
- MandrakeSoft Mandrake Linux 7.1
- MandrakeSoft Mandrake Linux 7.2
- MandrakeSoft Mandrake Linux 8.0
- MandrakeSoft Mandrake Linux 8.1
- MandrakeSoft Mandrake Linux 8.2
- MandrakeSoft Mandrake Linux Corporate Server 1.0.1
- MandrakeSoft Mandrake Single Network Firewall 7.2
- OpenPKG OpenPKG 1.0
- OpenPKG OpenPKG CURRENT
- OpenSSL OpenSSL 0.9.6 Beta3
- OpenSSL OpenSSL 0.9.6 Beta2
- OpenSSL OpenSSL 0.9.6 Beta1
- OpenSSL OpenSSL 0.9.6
- OpenSSL OpenSSL 0.9.6a Beta2
- OpenSSL OpenSSL 0.9.6a Beta3
- OpenSSL OpenSSL 0.9.6a
- OpenSSL OpenSSL 0.9.6a Beta1
- OpenSSL OpenSSL 0.9.6b
- OpenSSL OpenSSL 0.9.6c
- OpenSSL OpenSSL 0.9.6d
- OpenSSL OpenSSL 0.9.7
- OpenSSL OpenSSL 0.9.7 Beta1
- OpenSSL OpenSSL 0.9.7 Beta2
- Oracle Application Server 1.0.2.0
- Oracle Application Server 1.0.2.1
- Oracle Application Server 1.0.2.2
- Oracle Reports 9.0.2
- Oracle Reports 9.0.2.1
- RedHat Enterprise Linux 2.1 AS
- RedHat Linux 6.2
- RedHat Linux 7
- RedHat Linux 7.1
- RedHat Linux 7.2
- RedHat Linux 7.3
- RedHat Linux Advanced Workstation 2.1 Itanium
- SUSE SuSE Linux 7.0
- SUSE SuSE Linux 7.1
- SUSE SuSE Linux 7.3
- SUSE SuSE Linux 8.0
- Trustix Secure Linux 1.1
- Trustix Secure Linux 1.2
- Trustix Secure Linux 1.5
Reported:
Jul 30, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net