Alert GCSA-06070 - Vulnerabilita' in OpenSSL

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


*****************************************************************************

     Alert ID : GCSA-06070
         Data : 08 Settembre 2006
       Titolo : Vulnerabilita' in OpenSSL

*****************************************************************************


- - Descrizione del problema:

   E' stata identificata una vulnerabilita' nella libreria OpenSSL,
   relativa ad un controllo insufficiente del padding nelle firme PKCS #1 v1.5,
   nel caso in cui l'esponente della chiave pubblica sia 3.


- - Piattaforme e Software interessati:

   OpenSSL versioni 0.9.7 abcdefghij
                    0.9.8 ab
                    (e precedenti)

   RedHat Fedora Core5
   RedHat Enterprise Linux WS 2.1, 3 e 4
   RedHat Enterprise Linux ES 2.1, 3 e 4
   RedHat Enterprise Linux AS 2.1, 3 e 4
   RedHat Desktop 3.0 e 4.0
   Ubuntu versioni 5.04, 5.10, 6.06 LTS
   rPath Linux 1
   FreeBSD 6.0 e precedenti
   OpenBSD 3.2
   Slackware Linux 8.1
   Linux Mandrake 9.0, 9.1
   NetBSD 1.5.x, 1.6
   Mandriva Linux 2006.0, Corporate 3.0, Multi Network Firewall 2.0


- - Impatto:

   Questo difetto puo' essere sfruttato per costruire firme
   senza l'impiego della chiave segreta.


- - Soluzioni:

   Aggiornare a

   OpenSSL Project OpenSSL 0.9.7 k
   OpenSSL Project OpenSSL 0.9.8 c

   http://www.openssl.org/source/


- - Riferimenti:

OpenSSL Project
http://www.openssl.org/

OpenSSL Security Advisory [5th September 2006]
http://www.openssl.org/news/secadv_20060905.txt

SecurityFocus Bugtraq ID:
http://www.securityfocus.com/bid/19849

Mitre's CVE ID:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339

OpenPKG Project
http://www.openpkg.org/security/advisories/OpenPKG-SA-2006.018-openssl.html

FreeBSD Security Advisory
http://security.freebsd.org/advisories/FreeBSD-SA-06:19.openssl.asc

Red Hat Security Advisory
http://rhn.redhat.com/errata/RHSA-2006-0661.html

Ubuntu Security Notice:
http://www.ubuntu.com/usn/usn-339-1

Mandriva Linux Security Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:161

Gentoo Linux Security Advisory
http://www.gentoo.org/security/en/glsa/glsa-200609-05.xml

-----BEGIN PGP SIGNATURE-----

iQCVAwUBRQFYk/OB+SpikaiRAQK4lwP+Ozvh3cii3+7e7LWxQezLzCFv6aXA9Hvq
8WGWVN6bNqjNTAsApqe4tznjKaPb0bIsECjpp0x+NVgFL5KaIdlwS45n+NYNX4Ru
Z/iGTqfdR42N/rOGwyXIKU6B6b7pe3FTcQCY3lu7ZzER6KqyxgVnI0JVKKCQWZeJ
hhHsZJKvSQ8=
=+0XB
-----END PGP SIGNATURE-----