[openssl security] OpenSSL SSL_get_shared_ciphers() off-by-one buffer overflow

[Stephan Rügamer]

Binary package hint: openssl

openssl 0.9.8e and 0.9.7k still have a off-by-one buffer overflow...
this is fixed in latest openssl CVS...

Read about it: http://www.securityfocus.com/archive/1/480855/30/0/threaded
And CVS Fix: http://cvs.openssl.org/chngview?cn=16587

Please find attached a debdiff against latest version of openssl in gutsy

[Kees Cook (kees)]

openssl (0.9.8e-5ubuntu2) gutsy; urgency=low

  [ Jamie Strandboge ]
  * SECURITY UPDATE: off-by-one error in SSL_get_shared_ciphers() results in
    buffer overflow
  * ssl/ssl_lib.c: applied upstream patch from openssl CVS thanks to
    Stephan Hermann
  * References:
    CVE-2007-5135
    http://www.securityfocus.com/archive/1/archive/1/480855/100/0/threaded
    Fixes LP: #146269
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

  [ Kees Cook ]
  * SECURITY UPDATE: side-channel attacks via BN_from_montgomery function.
  * crypto/bn/bn_mont.c: upstream patch from openssl CVS thanks to Debian.
  * References
    CVE-2007-3108

 -- Kees Cook <email address hidden> Fri, 28 Sep 2007 13:02:19 -0700

[Kees Cook (kees)]

openssl (0.9.8c-4ubuntu0.1) feisty-security; urgency=low

  [ Jamie Strandboge ]
  * SECURITY UPDATE: off-by-one error in SSL_get_shared_ciphers() results in
    buffer overflow
  * ssl/ssl_lib.c: applied upstream patch from openssl CVS thanks to
    Stephan Hermann
  * References:
    CVE-2007-5135
    http://www.securityfocus.com/archive/1/archive/1/480855/100/0/threaded
    Fixes LP: #146269
  * Modify Maintainer value to match the DebianMaintainerField
    specification.

  [ Kees Cook ]
  * SECURITY UPDATE: side-channel attacks via BN_from_montgomery function.
  * crypto/bn/bn_mont.c: upstream patch from openssl CVS thanks to Debian.
  * References
    CVE-2007-3108

 -- Kees Cook <email address hidden> Fri, 28 Sep 2007 13:02:19 -0700

[Scott Kitterman (kitterman)]

This issue was not corrected before openssl097 was uploaded to the partner repository.

[Jamie Strandboge (jdstrand)]

http://www.ubuntu.com/usn/usn-522-1

[Jamie Strandboge (jdstrand)]

Marking Invalid as openssl097 is not in Gutsy (partner or otherwise).

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Steve Beattie (sbeattie)]

This was fixed for dapper's openssl package in openssl 0.9.8a-7ubuntu0.4 (see http://www.ubuntu.com/usn/usn-522-1), closing that task.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.