OpenSSL ASN1处理无效编码方式不当导致拒绝服务攻击漏洞

漏洞信息详情

OpenSSL ASN1处理无效编码方式不当导致拒绝服务攻击漏洞

• CNNVD编号：CNNVD-200208-052
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2002-0659
  
• 漏洞类型：
  
  
  边界条件错误
  
• 发布时间：
  
  2002-07-30
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2006-09-21
  
• 厂        商：
  
  apple
• 漏洞来源：
  James Yonan※ jim@n…

OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。
OpenSSL的ASN1解释器在处理无效的编码方式时存在漏洞，远程攻击者可能利用此漏洞对使用了ASN1库的应用程序进行拒绝服务攻击。

厂商补丁：
Caldera
——-
Caldera已经为此发布了一个安全公告(CSSA-2002-033.0)以及相应补丁:

CSSA-2002-033.0：Linux: multiple vulnerabilities in openssl

链接：http://www.caldera.com/support/security/advisories/CSSA-2002-033.0.txt” target=”_blank”>
http://www.caldera.com/support/security/advisories/CSSA-2002-033.0.txt

补丁下载：

* OpenLinux 3.1.1 Server

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-033.0/RPMS/openssl-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-033.0/RPMS/openssl-devel-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-033.0/RPMS/openssl-devel-static-0.9.6-18.i386.rpm

*. OpenLinux 3.1.1 Workstation

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-033.0/RPMS/openssl-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-033.0/RPMS/openssl-devel-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-033.0/RPMS/openssl-devel-static-0.9.6-18.i386.rpm

*. OpenLinux 3.1 Server

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-033.0/RPMS/openssl-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-033.0/RPMS/openssl-devel-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-033.0/RPMS/openssl-devel-static-0.9.6-18.i386.rpm

*. OpenLinux 3.1 Workstation

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-033.0/RPMS/openssl-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-033.0/RPMS/openssl-devel-0.9.6-18.i386.rpm

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-033.0/RPMS/openssl-devel-static-0.9.6-18.i386.rpm
Conectiva
———
Conectiva已经为此发布了一个安全公告(CLA-2002:513)以及相应补丁:

CLA-2002:513：openssl

链接：http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000513” target=”_blank”>
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000513

补丁下载：

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssl-0.9.6-4U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssl-devel-0.9.6-4U60_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/openssl-0.9.6-4U60_3cl.src.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-0.9.6a-3U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-devel-0.9.6a-3U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-devel-static-0.9.6a-3U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-doc-0.9.6a-3U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-progs-0.9.6a-3U70_3cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/openssl-0.9.6a-3U70_3cl.src.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-0.9.6c-2U8_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-devel-0.9.6c-2U8_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-devel-static-0.9.6c-2U8_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-doc-0.9.6c-2U8_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-progs-0.9.6c-2U8_1cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/8/SRPMS/openssl-0.9.6c-2U8_1cl.src.rpm

Conectiva Linux version 6.0及以上版本的用户可以使用apt进行RPM包的更新：

– 把以下的文本行加入到/etc/apt/sources.list文件中：

rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates

(如果你不是使用6.0版本，用合适的版本号代替上面的6.0)

– 执行: apt-get update

– 更新以后，再执行: apt-get upgrade
Debian
——
Debian已经为此发布了一个安全公告(DSA-136-1)以及相应补丁:

DSA-136-1：Multiple OpenSSL problems

链接：http://www.debian.org/security/2002/dsa-136” target=”_blank”>
http://www.debian.org/security/2002/dsa-136

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.0.dsc” target=”_blank”>
http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.0.dsc

Size/MD5 checksum: 782 de4c7b85648c7953dc31d3a89c38681c

http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.6c-2.woody.0.diff.gz” target=”_blank”>
http://security.debian.org/pool/updates/main/o/openssl/openssl_0