diff options
Diffstat (limited to 'share/security/advisories/FreeBSD-SA-01:51.openssl.asc')
| -rw-r--r-- | share/security/advisories/FreeBSD-SA-01:51.openssl.asc | 150 |
1 files changed, 0 insertions, 150 deletions
diff --git a/share/security/advisories/FreeBSD-SA-01:51.openssl.asc b/share/security/advisories/FreeBSD-SA-01:51.openssl.asc deleted file mode 100644 index e96590dd46..0000000000 --- a/share/security/advisories/FreeBSD-SA-01:51.openssl.asc +++ /dev/null @@ -1,150 +0,0 @@ ------BEGIN PGP SIGNED MESSAGE----- - -============================================================================= -FreeBSD-SA-01:51 Security Advisory - FreeBSD, Inc. - -Topic: OpenSSL 0.9.6a and earlier contain flaw in PRNG [REVISED] - -Category: core -Module: openssl -Announced: 2001-07-30 -Revised: 2001-07-31 -Credits: Markku-Juhani O. Saarinen <markku-juhani.saarinen@nokia.com> - The OpenSSL Project <URL:http://www.openssl.org/> -Affects: All releases of FreeBSD 4.x prior to 4.4, - FreeBSD 4.3-STABLE prior to the correction date -Corrected: 2001-07-19 21:00:45 UTC (FreeBSD 4.3-STABLE) - 2001-07-19 21:01:08 UTC (FreeBSD 4.3-SECURITY aka RELENG_4_3) -FreeBSD only: NO - -0. Revision History - -v1.0 2001-07-30 Initial release -v1.1 2001-07-31 Corrected patch instructions - -I. Background - -FreeBSD includes software from the OpenSSL Project. The OpenSSL -Project is a collaborative effort to develop a robust, -commercial-grade, full-featured, and Open Source toolkit implementing -the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS -v1) protocols as well as a full-strength general purpose cryptography -library. - -II. Problem Description - -A flaw in the pseudo-random number generator (PRNG) of OpenSSL -versions previous to 0.9.6b allows an attacker to determine the PRNG -state and future output under certain restricted conditions, thereby -weakening the strength of the PRNG and any cryptographic protection -which is derived from it. In effect, the flaw is that a portion of -the PRNG state is incorrectly used as the PRNG output, allowing -attackers to gain knowledge of the internal state of the PRNG by -observing the output if they can sample it in a certain way. - -An attack taking advantage of this flaw has been identified that can -recover the complete state of the PRNG from the output of one -carefully sized PRNG request followed by a few hundred consecutive -1-byte PRNG requests. - -This access pattern is not typically obtainable in real-world uses of -the PRNG in cryptographic protocols, and no exploit against a protocol -supported by OpenSSL is currently known. - -III. Impact - -By successfully exploiting a flaw in the PRNG, an attacker can gain -important information that may allow him to deduce nonces (leading to -the compromise of the protocol session) or encryption keys (allowing -the attacker to obtain the plaintext of the encrypted data). - -Whether or not this flaw is exploitable depends upon the specifics of -the application using OpenSSL. No vulnerable applications or -protocols are currently known. - -IV. Workaround - -None applicable. - -V. Solution - -One of the following: - -1) Upgrade your vulnerable FreeBSD system to 4.3-STABLE or the -4.3-SECURITY (aka RELENG_4_3) security branch after the respective -correction dates. - -2) FreeBSD 4.x systems prior to the correction date: - -The following patch have been verified to apply to FreeBSD -4.2-RELEASE, 4.3-RELEASE and 4.3-STABLE dated prior to the correction -date. These patches may or may not apply to older, unsupported -releases of FreeBSD. - -Download the patch and the detached PGP signature from the following -locations, and verify the signature using your PGP utility. - -ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:51/openssl.patch -ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:51/openssl.patch.asc - -# cd /usr/src/ -# patch -p < /path/to/patch -# cd /usr/src/secure/lib/libcrypto/ -# make depend && make all install - -One must also recompile any statically linked applications that use -OpenSSL's PRNG. There are no such applications in the base system. - -3) FreeBSD 4.3-RELEASE systems: - -An experimental upgrade package is available for users who wish to -provide testing and feedback on the binary upgrade process. This -package may be installed on FreeBSD 4.3-RELEASE systems only, and is -intended for use on systems for which source patching is not practical -or convenient. - -If you use the upgrade package, feedback (positive or negative) to -security-officer@FreeBSD.org is requested so we can improve the -process for future advisories. - -During the installation procedure, backup copies are made of the files -which are replaced by the package. These backup copies will be -reinstalled if the package is removed, reverting the system to a -pre-patched state. - -# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:51/security-patch-openssl-01.51.tgz -# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/packages/SA-01:51/security-patch-openssl-01.51.tgz.asc - -Verify the detached PGP signature using your PGP utility. - -# pkg_add security-patch-openssl-01.51.tgz - -VI. Correction details - -The following list contains the revision numbers of each file that was -corrected for the maintained versions of FreeBSD. - -FreeBSD Version and CVS Tag - Path Revision -- ------------------------------------------------------------------------- -FreeBSD 4.3-SECURITY (tag: RELENG_4_3) - src/crypto/openssl/crypto/rand/md_rand.c 1.1.1.1.2.2.2.1 -FreeBSD 4.3-STABLE (tag: RELENG_4) - src/crypto/openssl/crypto/rand/md_rand.c 1.1.1.1.2.4 -- ------------------------------------------------------------------------- - -VII. References - -<URL:http://www.openssl.org/source/exp/CHANGES> -<URL:http://www.securityfocus.com/bid/3004> ------BEGIN PGP SIGNATURE----- -Version: GnuPG v1.0.6 (FreeBSD) -Comment: For info see http://www.gnupg.org - -iQCVAwUBO2cIaFUuHi5z0oilAQHilgQAq8VsYlRClfALI5NLhJ5HPJpI+WZYr9wp -rhPygQgYKuTsM89XYi3Cz3OUxNP7l4x1Zp846DHLS+9TVuOWxclxxWCvwybcIT/L -3uhqwTAVM225g7TqDdc3kq0sFVTs3NRb13PgPz84QUdl/DcYkikfH49SSbvrQvch -hHGsw1Ohiao= -=R/xp ------END PGP SIGNATURE----- |