Lucene search

K
amazonAmazonALAS-2012-038
HistoryFeb 02, 2012 - 2:24 p.m.

Medium: openssl

2012-02-0214:24:00
alas.aws.amazon.com
23

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.185 Low

EPSS

Percentile

96.1%

Issue Overview:

It was discovered that the Datagram Transport Layer Security (DTLS) protocol implementation in OpenSSL leaked timing information when performing certain operations. A remote attacker could possibly use this flaw to retrieve plain text from the encrypted packets by using a DTLS server as a padding oracle. (CVE-2011-4108)

An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576)

A denial of service flaw was found in the RFC 3779 implementation in OpenSSL. A remote attacker could use this flaw to make an application using OpenSSL exit unexpectedly by providing a specially-crafted X.509 certificate that has malformed RFC 3779 extension data. (CVE-2011-4577)

It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619)

Affected Packages:

openssl

Issue Correction:
Run yum update openssl to update your system.

New Packages:

i686:  
    openssl-1.0.0g-1.26.amzn1.i686  
    openssl-perl-1.0.0g-1.26.amzn1.i686  
    openssl-devel-1.0.0g-1.26.amzn1.i686  
    openssl-debuginfo-1.0.0g-1.26.amzn1.i686  
    openssl-static-1.0.0g-1.26.amzn1.i686  
  
src:  
    openssl-1.0.0g-1.26.amzn1.src  
  
x86_64:  
    openssl-static-1.0.0g-1.26.amzn1.x86_64  
    openssl-debuginfo-1.0.0g-1.26.amzn1.x86_64  
    openssl-devel-1.0.0g-1.26.amzn1.x86_64  
    openssl-perl-1.0.0g-1.26.amzn1.x86_64  
    openssl-1.0.0g-1.26.amzn1.x86_64  

Additional References

Red Hat: CVE-2011-4108, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619

Mitre: CVE-2011-4108, CVE-2011-4576, CVE-2011-4577, CVE-2011-4619

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.185 Low

EPSS

Percentile

96.1%