[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [opensuse-security] AW: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL



Hi,
nothing special here, yesterday we talked about openssl1 and the advisory mentioned below is an openssl 0.9 update for SLE11 which also contains the new SCSV feature. With this feature an application that uses it can detect downgrade attacks.
Still, your services should be configured to only use TLS.

HTH
Thomas


On November 6, 2014 7:51:00 AM CET, hans.paffrath@xxxxxxxxxxxxxx wrote:
Hello,

yesterday, you pronounced a patch for sle11 openssl1.

SUSE-SU-2014:1357-1

When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product.

Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here:

https://www.suse.com/support/kb/doc.php?id=7015773

Thanks.


Mit freundlichem Gruß
Hans Paffrath

Stadt Köln - Der Oberbürgermeister
Amt für Informationsverarbeitung
Willy-Brandt-Platz 3
50679 Köln

Telefon: 0221/221-26085
Telefax: 0221/221-22845
E-Mail: hans.paffrath@xxxxxxxxxxxxxx
Internet: www.stadt-koeln.de



-----Ursprüngliche Nachricht-----
Von: opensuse-security@xxxxxxxxxxxx [mailto:opensuse-security@xxxxxxxxxxxx]
Gesendet: Mittwoch, 5. November 2014 23:05
An: opensuse-security-announce@xxxxxxxxxxxx
Betreff: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL

SUSE Security Update: Security update for OpenSSL


Announcement ID: SUSE-SU-2014:1361-1
Rating: important
References: #892403 #901223 #901277
Cross-References: CVE-2014-3566 CVE-2014-3567 CVE-2014-3568

Affected Products:
SUSE Linux Enterprise Software Development Kit 11 SP3
SUSE Linux Enterprise Server 11 SP3 for VMware
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Desktop 11 SP3


An update that fixes three vulnerabilities is now availabl e.

Description:


This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Indications:

Everybody should update.

Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Software Development Kit 11 SP3:

zypper in -t patch sdksp3-libopenssl-devel-9915

- SUSE Linux Enterprise Server 11 SP3 for VMware:

zypper in -t patch slessp3-libopenssl-devel-9915

- SUSE Linux Enterprise Server 11 SP3:

zypper in -t patch slessp3-libopenssl-devel-9915

- SUSE Linux Enterprise Desktop 11 SP3:

zypper in -t patch sledsp3-libopenssl-devel-9915

To bring your system up-to-date, use "zypper patch".


Package List:

- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):

libopenssl-devel-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

libopenssl0_9_8-0.9.8j-0.66.1
libopenssl0_9_8-hmac-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1
openssl-doc-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.66.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):

libopenssl0_9_8-0.9.8j-0.66.1
libopenssl0_9_8-hmac-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1
openssl-doc-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.66.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 (ia64):

libopenssl0_9_8-x86-0.9.8j-0.66.1

- SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

libopenssl0_9_8-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1

- SUSE Linux Enterprise Desktop 11 SP3 (x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.66.1


References:

http://support.novell.com/security/cve/CVE-2014-3566.html
http://support.novell.com/security/cve/CVE-2014-3567.html
http://support.novell.com/security/cve/CVE-2014-3568.html
https://bugzilla.suse.com/show_bug.cgi?id=892403
https://bugzilla.suse.com/show_bug.cgi?id=901223
https://bugzilla.suse.com/show_bug.cgi?id=901277
http://download.suse.com/patch/finder/?keywords=e15c3470343095d331f7120ec6953c18

--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-security-announce+help@xxxxxxxxxxxx

--
To unsubscribe, e-mail: opensuse-security+unsubscribe@xxxxxxxxxxxx
To contact the owner, e-mail: opensuse-security+owner@xxxxxxxxxxxx


--
Thomas Biege <thomas@xxxxxxx>, Team Leader MaintenanceSecurity, CSSLP
SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB
21284 (AG Nürnberg)