[Full-disclosure] [ GLSA 200510-11 ] OpenSSL: SSL 2.0 protocol rollback

[Thierry Carrez]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200510-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Low
     Title: OpenSSL: SSL 2.0 protocol rollback
      Date: October 12, 2005
      Bugs: #108852
        ID: 200510-11

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

When using a specific option, OpenSSL can be forced to fallback to the
less secure SSL 2.0 protocol.

Background
==========

OpenSSL is a toolkit implementing the Secure Sockets Layer, Transport
Layer Security protocols and a general-purpose cryptography library.

Affected packages
=================

    -------------------------------------------------------------------
     Package           /  Vulnerable  /                     Unaffected
    -------------------------------------------------------------------
  1  dev-libs/openssl     < 0.9.8-r1                       >= 0.9.8-r1
                                                            *>= 0.9.7h
                                                         *>= 0.9.7g-r1
                                                         *>= 0.9.7e-r2

Description
===========

Applications setting the SSL_OP_MSIE_SSLV2_RSA_PADDING option (or the
SSL_OP_ALL option, that implies it) can be forced by a third-party to
fallback to the less secure SSL 2.0 protocol, even if both parties
support the more secure SSL 3.0 or TLS 1.0 protocols.

Impact
======

A man-in-the-middle attacker can weaken the encryption used to
communicate between two parties, potentially revealing sensitive
information.

Workaround
==========

If possible, disable the use of SSL 2.0 in all OpenSSL-enabled
applications.

Resolution
==========

All OpenSSL users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose dev-libs/openssl

References
==========

  [ 1 ] CAN-2005-2969
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2969
  [ 2 ] OpenSSL security advisory
        http://www.openssl.org/news/secadv_20051011.txt

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200510-11.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security at gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051012/3cc0e58d/attachment.bin