AV:N/AC:M/Au:M/C:P/I:P/A:N/E:U/RL:OF/RC:C
-
OpenSSL contains vulnerabilities that could allow an unauthenticated, remote attacker to bypass security restrictions.
The first vulnerability (CVE-2005-2969) affects any application using a SL/TLS server implementation provided by OpenSSL versions 0.9.7g and prior. If these implementations have options designed to mitigate third party bugs enabled, a remote attacker conducting a man-in-the-middle attack could force connections between the hosts to use the 2.0 version of the SSL protocol. A known cryptographic weaknesses exists in the SSL 2.0 protocol.
The second vulnerability (CVE-2005-2946) exists in the default configuration of OpenSSL versions prior to 0.9.8a. This configuration creates message digests using MD5. Weaknesses in the cryptographic algorithm could allow a remote attacker to forge certificates with valid certificate authority signatures.
OpenSSL confirmed this vulnerability in a security advisory and released updates.
Attackers are unlikely to exploit these vulnerabilities due to the man-in-the-middle attack vector. Such attacks are very difficult to perform due to the requirement of intercepting and modifying traffic between two hosts in real time. Man-in-the-middle attack are typically only useable by an attacker with physical access to the devices or connections between a customer and service provider.
There have been a number of demonstrations recently of weaknesses in the MD5 algorithm. While MD5 is technically broken, it is not insecure. It is unlikely that an attacker could successfully create an MD5 collision for use in signing a fake certificate.
Administrators should not take particular concern with either of these issues. Administrators may consider waiting to update productions systems until full testing of the updated version is complete. If concern of these issues does arise, administrators may consider removing the IE 3.x compatibility flag.
-
OpenSSL has released a security advisory at the following link: secadv_20051011
Apple has released a security announcement at the following link: Security Update 2005-009Astaro has released security announcements at the following links: Up2Date 4.029, Up2Date 5.208 and Up2Date 6.101
Avaya has released security advisories at the following links: ASA-2006-031 and ASA-2006-260
Blue Coat has released a security advisory at the following link: Blue Coat Security Advisory
Cisco has released a security response to address Cisco bug IDs CSCsc27533, CSCej54402, CSCsc48330, CSCsc33835, CSCsc58356 and CSCek01123 at the following link: 68324
Debian has released security advisories at the following links: DSA-875-1, DSA-881-1, DSA-882-1 and DSA-888-1
FreeBSD has released a security advisory at the following FTP link: FreeBSD-SA-05:21.openssl
Gentoo has released a security advisory at the following link: GLSA 200510-11
HP has released a list of affected products in PDF format at the following FTP link: HP. HP has released security advisories at the following link: HPSBUX02174 and HPSBUX02186
Hitachi has released security advisories at the following links: HS06-022-01 and HS07-016
IBM has released vulnerability descriptions at the following links:
SSRVHMCHMC_C081516_474
SSRVHMCHMC_C081516_604
SSRVHMCHMC_C081516_754Juniper has released a security bulletin at the following link: PSN-2005-12-025
Mandriva has released a security advisory at the following link: MDKSA-2005:179
NetBSD has released a security advisory at the following FTP link: NetBSD-SA2005-010
OpenPKG has released a security advisory at the following link: OpenPKG-SA-2005.022
Red Hat has released security advisories at the following links: RHSA-2005:800, RHSA-2005:882, RHSA-2008:0264, RHSA-2008:0525, and RHSA-2008:0629
The SCO Group has released a security advisory at the following FTP link: SCOSA-2005.48
SGI has released a security advisory at the following FTP link: 20051003-01-U
Slackware has released a security advisory at the following link: SSA:2005-286-01
Sun has re-released an alert notification at the following link: 201126
SUSE has released a security announcement at the following link: SUSE-SA:2005:061
Trustix has released security advisories at the following links: TSLSA-2005-0057 and TSLSA-2005-0059
Ubuntu Linux has released security notices at the following links: USN-179-1 and USN-204-1
-
Administrators are advised to apply the appropriate update.
Administrators are advised to disable the 2.0 version of the SSL protocol in OpenSSL applications.
Administrators may consider removing the affected flags to mitigate the SSL rollback vulnerability.
-
OpenSSL has released a patch at the following link: patch-CAN-2005-2969.txt
Updated versions are available at the following link: OpenSSL 0.9.7h or 0.9.8a
Apple has released updates at the following links:
Mac OS X 10.3.9 client
Mac OS X 10.3.9 server
Mac OS X 10.4.3 client
Mac OS X 10.4.3 serverAstaro has released updated packages for Astaro Security Linux at the following FTP links: Astaro 5.208 and Astaro 6.101. Users can also obtain the latest packages by issuing the up2date command.
Blue Coat has released updates for registered users at the following link: Blue Coat
Cisco customers with active contracts can obtain updates through the Software Center at the following link: Cisco. Cisco customers without contracts can obtain upgrades by contacting the Cisco Technical Assistance Center at 1-800-553-2447 or 1-408-526-7209 or via e-mail at tac@cisco.com.
Debian has released updated packages at the following links: Debian 3.0 (openssl094), Debian 3.0 (openssl095), Debian 3.1 (openssl096) and Debian 3.0/3.1 (openssl096c)
FreeBSD has released a patch at the following FTP link: openssl.patch
Gentoo updates can be obtained for the following package using the emerge command: dev-libs/openssl
HP has released an updated HTTP Server version at the following link: HP HTTP Server 5.97. HP has released updated packages for HP-UX at the following links:
HP-UX 11.11
revision A.00.09.07l or laterHP-UX 11.23
revision A.00.09.07l.001 or laterHitachi has made updates available through normal Hitachi support channels.
IBM has released the following updates:
Juniper has released updated versions of IVE OS for registered users at the following link: IVE OS Software
Mandriva can be updated automatically using MandrivaUpdate.
NetBSD has released updated packages at the following FTP link: NetBSD
OpenPKG has released updated packages at the following FTP links:
OpenPKG 2.3 - openssl-0.9.7e-2.3.3
OpenPKG 2.4 - openssl-0.9.7g-2.4.2Red Hat packages can be updated using the up2date or yum command.
The SCO Group has released updated packages at the following FTP link: openssl-0.9.7i.image
SGI has released a patch for ProPack 3 Service Pack 6 for registered users at the following link: Patch 10235
Slackware packages can be updated using the upgradepkg command.
Sun has released patches at the following links:
SPARC
Solaris 10 - 120011-14Intel
Solaris 10 - 127128-11SUSE has released updated packages; users can install the updates using YaST.
Trustix products can be updated using the swup --upgrade command.
Ubuntu has released updated packages; users can install the updates using Update Manager.
-
The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.
-
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
-
Version Description Section Status Date 1.0 Initial Release NA Final 2005-Oct-12
-
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy, and may lack important information or contain factual errors. The information in this document is intended for end-users of Cisco products.