OpenSSL CBC错误信息泄露漏洞

漏洞信息详情

OpenSSL CBC错误信息泄露漏洞

• CNNVD编号：CNNVD-200303-024
• 危害等级： 中危
  
  
• CVE编号：
  CVE-2003-0078
  
• 漏洞类型：
  
  
  设计错误
  
• 发布时间：
  
  2003-03-03
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-12
  
• 厂        商：
  
  openbsd
• 漏洞来源：
  Discovery credited…

OpenSSL 0.9.7a之前的版本和0.9.6i之前的0.9.6版本中s3_pkt.c的ssl3_get_record如果使用不正确分组密码进行填充，将不执行MAC计算，可以导致信息泄露（时序差异），该漏洞可能更容易导致凭借区分填充和MAC检验错误差别的加密攻击，并且可能导致原始明文被提取，也称为“Vaudenay timing attack”。

It is reported that certain versions of Computer Associates eTrust Security Command Center are prone to this vulnerability. Customers are advised to contact the vendor for further information pertaining to obtaining and applying appropriate updates.
Hewlett-Packard has released an advisory (HPSBUX0309-280), which contains fix information to address this issue in J2SE and JSSE. Customers are advised to upgrade as soon as possible. Further information regarding obtaining and applying fixes can be found in the referenced advisory.
NetBSD has released an advisory (2003-001) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
Administrators and users are advised to upgrade to version 0.9.6i or 0.9.7a. OpenPKG has released upgrade RPMs.
Conectiva has released an advisory (CLA-2003:570) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
Debian has released an advisory (DSA 253-1) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
Gentoo Linux have recommended that users who are running ‘dev-libs/openssl’ upgrade to ‘openssl-0.9.6i’ or ‘openssl-0.9.7a’ as follows:
emerge sync
emerge -u openssl
emerge clean
Mandrake has released an advisory (MDKSA-2003:020) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
Trustix has released an advisory (TSLSA-2003-0005) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
EnGarde has released an advisory ([ESA-20030220-005) which addresses this issue. Fix details may be found in the attached advisory.
FreeBSD has released an updated Security Advisory. Users are advised to apply the new patches or to upgrade systems via CVS. Further information is available in the referenced advisory.
OpenBSD has released security patches which address this issue. Further information is available from the OpenBSD eratta pages.
SuSE has released an advisory (SuSE-SA:2003:011) which addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
Apple has released an advisory which contains a fix for this issue. Further information is available from the Apple Security Update page.
Red Hat Linux has released an advisory (RHSA-2003:062-11) containing fixes. Information about obtaining and applying fixes are available in the referenced advisory.
Sun has released updated versions of the affected products to address this issue.
Sun has also released an alert stating that this issue has been addressed in the latest release of JSSE, SDK, and JRE.
HP has released advisory HPSBUX0303-248 (rev. 1) to address this issue.
HP has released advisory HPSBUX0303-248 (rev. 2) to address this issue.
Oracle has released an advisory and patches to address this issue. User are advised to obtain patches from the Oracle metalink site listed in references.
Fixes available:
OpenBSD OpenBSD 3.2

• OpenBSD 007_ssl.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/007_ssl.patch

Sun Cobalt RaQ 4

• Sun RaQ4-All-Security-2.0.1-16343.pkg
  
  http://ftp.cobalt.sun.com/pub/packages/raq4/eng/RaQ4-All-Security-2.0.
  1-16343.pkg

Sun Cobalt RaQ 550

• Sun RaQ550-All-Security-0.0.1-16343.pkg
  
  http://ftp.cobalt.sun.com/pub/packages/raq550/all/RaQ550-All-Security-
  0.0.1-16343.pkg

Sun Cobalt RaQ XTR

• Sun RaQ550-All-Security-0.0.1-16343.pkg
  
  http://ftp.cobalt.sun.com/pub/packages/raq550/all/RaQ550-All-Security-
  0.0.1-16343.pkg
• Sun RaQXTR-All-Security-1.0.1-16343.pkg
  
  http://ftp.cobalt.sun.com/pub/packages/raqxtr/eng/RaQXTR-All-Security-
  1.0.1-16343.pkg

Sun Cobalt Qube 3

• Sun Qube3-All-Security-4.0.1-16343.pkg
  
  http://ftp.cobalt.sun.com/pub/packages/qube3/ml/Qube3-All-Security-4.0
  .1-16343.pkg

OpenBSD OpenBSD 3.1

• OpenBSD 021_ssl.patch
  ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/021_ssl.patch

OpenSSL Project OpenSSL 0.9.3

• OpenSSL Project openssl-0.9.6i.tar.gzOpenSSL 0.9.6i upgrade.
  
  http://www.openssl.org/source/openssl-0.9.6i.tar.gz

OpenSSL Project OpenSSL 0.9.4

• OpenSSL Project openssl-0.9.6i.tar.gzOpenSSL 0.9.6i upgrade.
  
  http://www.openssl.org/source/openssl-0.9.6i.tar.gz

OpenSSL Project OpenSSL 0.9.5 a

• Mandrake openssl-0.9.5a-9.4mdk.i586.rpmMandrake Linux 7.2
  
  http://www.mandrakesecure.net/en/ftp.php
• Mandrake openssl-devel-0.9.5a-9.4mdk.i586.rpmMandrake Linux 7.2
  
  http://www.mandrakesecure.net/en/ftp.php
• OpenSSL Project openssl-0.9.6i.tar.gzOpenSSL 0.9.6i upgrade.
  
  http://www.openssl.org/source/openssl-0.9.6i.tar.gz

OpenSSL Project OpenSSL 0.9.5

• OpenSSL Project openssl-0.9.6i.tar.gzOpenSSL 0.9.6i upgrade.
  
  http://www.openssl.org/source/openssl-0.9.6i.tar.gz

OpenSSL Project OpenSSL 0.9.6 d

• OpenSSL Project openssl-0.9.6i.tar.gzOpenSSL 0.9.6i upgrade.
  
  http://www.openssl.org/source/openssl-0.9.6i.tar.gz

OpenSSL Project OpenSSL 0.9.6 c

• Conectiva openssl-0.9.6-4U60_5cl.i386.rpmConectiva Linux Version 6.0
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/openssl-0.9.6-4U60_5cl.i3
  86.rpm
• Conectiva openssl-0.9.6-4U60_5cl.src.rpmConectiva Linux Version 6.0
  ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/openssl-0.9.6-4U60_5cl.s
  rc.rpm
• Conectiva openssl-0.9.6c-2U80_4cl.i386.rpmConectiva Linux Version 8.0
  ftp://atualizacoes.conectiva.com.br/8/RPMS/openssl-0.9.6c-2U80_4cl.i38
  6.rpm
• Conectiva openssl-0.9.6c-2U80_4cl.src.rpmConectiva Linux Version 8.0
  ftp://atualizacoes.conectiva.com.br/8/SRPMS/openssl-0.9.6c-2U80_4cl.sr
  c.rpm
• Conectiva openssl-devel-0.9.6-4U60_5cl.i386.rpmConectiva Linux Version 6.0
  ftp://atualizacoes.conecti