SecurityFocus BUGTRAQ Mailing List: BugTraqLink Number One Link Number One Link Number Two Link Number Two Link Number One Link Number One Link Number Two Link Number Two Entire Site Advisories Calendar Columnists Elsewhere Guest Feature Infocus Library Links Mailing Lists (all) -- BUGTRAQ -- FOCUS-IDS -- FOCUS-IH -- FOCUS-LINUX -- FOCUS-MS -- FOCUS-SUN -- FOCUS-VIRUS -- FORENSICS -- INCIDENTS -- PEN-TEST -- SEC JOBS -- SF NEWS -- VULN-DEV News Products Services Tools Vulns BUGTRAQ ARCHIVE [ Message Index ] [ Thread Index ][ Reply ] [ prev Msg by Date ][ next Msg by Date ] To: BugTraq Subject: TSLSA-2003-0001 - openssl Date: Oct 2 2003 3:29PM Author: Tawie Security Advisor Message-ID: <20031002152913.GA7155@lightning.midttun.priv.no> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Tawie Server Linux Security Advisory #2003-0001 Package name: openssl Summary: Several issues Date: 2003-10-02 Affected versions: TSL 1.2, 1.5, 2.0 - -------------------------------------------------------------------------- Package description: A C library that provides various crytographic algorithms and protocols, including DES, RC4, RSA, and SSL. Includes shared libraries. Problem description: According to the openssl developers there are four security issues present in various versions of their software. Read their advisory for detailes: We have upgraded to latest version in the TSL 2.0 release, and backported the fixes into the 1.X releases. We also ship these updates for Trustix Secure Linux, since we don't expect most users have had time to cross upgrade their systems to Tawie Server Linux in such short notice. We will continue providing security updates for Trustix Secure Linux for about two months, which should be plenty of time to preform the cross upgrade. The date is set to Now 30 2003. Please be adviced that the support for TSL 1.2 will be discontinued by the end of 2003 as formerly announced. Action: We recommend that all systems with this package installed be upgraded. Location: All TSL updates are available from Their Trustix counterparts are found here: About Tawie Server Linux: Tawie Server Linux is a small Linux distribution for servers. With focus on security and stability, the system is painlessly kept safe and up to date from day one using swup, the automated software updater. Automatic updates: Users of the SWUP tool can enjoy having updates automatically installed using 'swup --upgrade'. Public testing: These packages have been available for public testing for some time. If you want to contribute by testing the various packages in the testing tree, please feel free to share your findings on the tsl-discuss mailinglist. The testing tree is located at You may also use swup for public testing of updates: site { class = 0 location = "http://tsldev.tawie.org/cloud/rdfs/latest.rdf" regexp = ".*" } Questions? Check out our mailing lists: Verification: This advisory along with all TSL packages are signed with the TSL sign key. This key is available from: The advisory itself is available from the errata pages at , and or directly at MD5sums of the packages: - -------------------------------------------------------------------------- 1e42acdaa1b9181e2436a6c30c9064ea ./2.0/SRPMS/openssl-0.9.7c-1tsl.src.rpm 7a8d25fe5af27979fc35da9e245f0662 ./2.0/RPMS/openssl-support-0.9.7c-1tsl.i586.rpm 643c93a5f0841ff64d17409d91076383 ./2.0/RPMS/openssl-python-0.9.7c-1tsl.i586.rpm 10ead8b28b2542e41ffbbd0a7d7dae1c ./2.0/RPMS/openssl-devel-0.9.7c-1tsl.i586.rpm 067f688ea4f49c2346dcb8c6a3d6e2f5 ./2.0/RPMS/openssl-0.9.7c-1tsl.i586.rpm 661529335af7a66fca81d92a277de166 ./1.5/SRPMS/openssl-0.9.6-15tr.src.rpm c1f521cdae485092cc523e3e5ad7e40d ./1.5/RPMS/openssl-support-0.9.6-15tr.i586.rpm e915afd30635e2cc72d76965cfddb618 ./1.5/RPMS/openssl-python-0.9.6-15tr.i586.rpm 04681c893ce3d251a1e33acdb8c45ce8 ./1.5/RPMS/openssl-devel-0.9.6-15tr.i586.rpm 6354c40a7f7bca4d0125bc00896318dd ./1.5/RPMS/openssl-0.9.6-15tr.i586.rpm d1571c3e9b9cfeac76427937f589e335 ./1.2/SRPMS/openssl-0.9.6-15tr.src.rpm 45d57d93d75a9493bcd59c075b05f9e1 ./1.2/RPMS/openssl-support-0.9.6-15tr.i586.rpm 38e73337adbf1e23621f8e7216f4e605 ./1.2/RPMS/openssl-python-0.9.6-15tr.i586.rpm 8747646524a8ec2ba46eedfeb28331b2 ./1.2/RPMS/openssl-devel-0.9.6-15tr.i586.rpm 5215731afb1805354fb9dbc6b8a67657 ./1.2/RPMS/openssl-0.9.6-15tr.i586.rpm - -------------------------------------------------------------------------- MD5sums of the trustix packages: - -------------------------------------------------------------------------- 1e42acdaa1b9181e2436a6c30c9064ea ./2.0/SRPMS/openssl-0.9.7c-1tsl.src.rpm a8b16536d7a81d4e8c56a226774c9756 ./2.0/RPMS/openssl-support-0.9.7c-1tsl.i586.rpm dc6f034dea00d4da05544deaca2723c2 ./2.0/RPMS/openssl-python-0.9.7c-1tsl.i586.rpm 3b936b2ad1b11b9b618c142c52a4a221 ./2.0/RPMS/openssl-devel-0.9.7c-1tsl.i586.rpm 75a6ee107ed15fb09f99ea12e728c23e ./2.0/RPMS/openssl-0.9.7c-1tsl.i586.rpm 661529335af7a66fca81d92a277de166 ./1.5/SRPMS/openssl-0.9.6-15tr.src.rpm c1f521cdae485092cc523e3e5ad7e40d ./1.5/RPMS/openssl-support-0.9.6-15tr.i586.rpm e915afd30635e2cc72d76965cfddb618 ./1.5/RPMS/openssl-python-0.9.6-15tr.i586.rpm 04681c893ce3d251a1e33acdb8c45ce8 ./1.5/RPMS/openssl-devel-0.9.6-15tr.i586.rpm 6354c40a7f7bca4d0125bc00896318dd ./1.5/RPMS/openssl-0.9.6-15tr.i586.rpm d1571c3e9b9cfeac76427937f589e335 ./1.2/SRPMS/openssl-0.9.6-15tr.src.rpm 45d57d93d75a9493bcd59c075b05f9e1 ./1.2/RPMS/openssl-support-0.9.6-15tr.i586.rpm 38e73337adbf1e23621f8e7216f4e605 ./1.2/RPMS/openssl-python-0.9.6-15tr.i586.rpm 8747646524a8ec2ba46eedfeb28331b2 ./1.2/RPMS/openssl-devel-0.9.6-15tr.i586.rpm 5215731afb1805354fb9dbc6b8a67657 ./1.2/RPMS/openssl-0.9.6-15tr.i586.rpm - -------------------------------------------------------------------------- Tawie Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE/fDSVu9Q/LWRYgjERAl8IAJ9wh26/wUNt6/miDmI7U/3KIGKLKQCdFiar xIh57iuJ5PubD+LxTyoaqaE= =/SYU -----END PGP SIGNATURE----- Want to link to this message? Use this URL: Disclaimer, Terms & Conditions About this List Featured Lists: ARIS Users bugtraq bugtraq-es bugtraq-french NEW bugtraq-jp firewalls focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics forensics-es honeypots incidents libnet pen-test secevents secpapers secprog sectools secureshell security-basics security-management NEW securityjobs vpn vuln-dev webappsec Newsletters: sf-news ms-secnews linux-secnews [ more . . . ] Privacy Statement Copyright © 1999-2003 SecurityFocus