[CVE-2009-0050] - Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSA_verify function

[Stefan Lesicnik]

Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

[Stefan Lesicnik (stefanlsd)]

Please sync lasso_2.2.1-2 from Debian Unstable (main) for Jaunty fix.

[Jamie Strandboge (jdstrand)]

Please sync lasso 2.2.1-2 from Debian unstable to Jaunty.

[Jamie Strandboge (jdstrand)]

Thanks Stefan! I'm processing the Dapper-Intrepid debdiffs now.

[Launchpad Janitor (janitor)]

This bug was fixed in the package lasso - 2.0.0-1ubuntu1.1

---------------
lasso (2.0.0-1ubuntu1.1) gutsy-security; urgency=low

  * SECURITY UPDATE: lasso does not properly check the return value from the
    OpenSSL DSA_verify function (LP: #317181).
    - lasso/xml/tools.c: Correctly check for signature validity.
    - CVE-2009-0050

 -- Stefan Lesicnik <email address hidden> Wed, 14 Jan 2009 20:23:28 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package lasso - 2.1.1-2ubuntu1.1

---------------
lasso (2.1.1-2ubuntu1.1) hardy-security; urgency=low

  * SECURITY UPDATE: lasso does not properly check the return value from the
    OpenSSL DSA_verify function (LP: #317181).
    - lasso/xml/tools.c: Correctly check for signature validity.
    - CVE-2009-0050

 -- Stefan Lesicnik <email address hidden> Wed, 14 Jan 2009 20:18:30 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package lasso - 2.2.0-1ubuntu0.1

---------------
lasso (2.2.0-1ubuntu0.1) intrepid-security; urgency=low

  * SECURITY UPDATE: lasso does not properly check the return value from the
    OpenSSL DSA_verify function (LP: #317181).
    - lasso/xml/tools.c: Correctly check for signature validity.
    - CVE-2009-0050

 -- Stefan Lesicnik <email address hidden> Wed, 14 Jan 2009 19:56:22 +0200

[Colin Watson (cjwatson)]

[Updating] lasso (2.2.1-1 [Ubuntu] < 2.2.1-2 [Debian])
 * Trying to add lasso...
  - <lasso_2.2.1-2.dsc: downloading from http://ftp.debian.org/debian/>
  - <lasso_2.2.1-2.diff.gz: downloading from http://ftp.debian.org/debian/>
  - <lasso_2.2.1.orig.tar.gz: already in distro - downloading from librarian>
I: lasso [universe] -> liblasso3-dev_2.2.1-1 [universe].
I: lasso [universe] -> liblasso3_2.2.1-1 [universe].
I: lasso [universe] -> python-lasso_2.2.1-1 [universe].
I: lasso [universe] -> liblasso-java_2.2.1-1 [universe].
I: lasso [universe] -> liblasso-perl_2.2.1-1 [universe].
I: lasso [universe] -> php5-lasso_2.2.1-1 [universe].

[Colin Watson (cjwatson)]

[Updating] lasso (2.2.1-1 [Ubuntu] < 2.2.1-2 [Debian])
 * Trying to add lasso...
  - <lasso_2.2.1-2.dsc: cached>
  - <lasso_2.2.1-2.diff.gz: cached>
  - <lasso_2.2.1.orig.tar.gz: already in distro - downloading from librarian>
I: lasso [universe] -> liblasso3-dev_2.2.1-1 [universe].
I: lasso [universe] -> liblasso3_2.2.1-1 [universe].
I: lasso [universe] -> python-lasso_2.2.1-1 [universe].
I: lasso [universe] -> liblasso-java_2.2.1-1 [universe].
I: lasso [universe] -> liblasso-perl_2.2.1-1 [universe].
I: lasso [universe] -> php5-lasso_2.2.1-1 [universe].

[Colin Watson (cjwatson)]

(Sorry about the duplicate comment there.)