AW: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL

classic Classic list List threaded Threaded
3 messages Options
Reply | Threaded
Open this post in threaded view
|

AW: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL

hans.paffrath
Hello,

yesterday, you pronounced a patch for sle11 openssl1.

SUSE-SU-2014:1357-1

When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product.

Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here:

https://www.suse.com/support/kb/doc.php?id=7015773

Thanks.


Mit freundlichem Gruß
Hans Paffrath

Stadt Köln - Der Oberbürgermeister
Amt für Informationsverarbeitung
Willy-Brandt-Platz 3
50679 Köln

Telefon: 0221/221-26085
Telefax: 0221/221-22845
E-Mail: [hidden email]
Internet: www.stadt-koeln.de

 

-----Ursprüngliche Nachricht-----
Von: [hidden email] [mailto:[hidden email]]
Gesendet: Mittwoch, 5. November 2014 23:05
An: [hidden email]
Betreff: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL

   SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________

Announcement ID:    SUSE-SU-2014:1361-1
Rating:             important
References:         #892403 #901223 #901277
Cross-References:   CVE-2014-3566 CVE-2014-3567 CVE-2014-3568
                   
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11 SP3
                    SUSE Linux Enterprise Server 11 SP3 for VMware
                    SUSE Linux Enterprise Server 11 SP3
                    SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________

   An update that fixes three vulnerabilities is now available.

Description:


   This OpenSSL update fixes the following issues:

       * Session Ticket Memory Leak (CVE-2014-3567)
       * Build option no-ssl3 is incomplete (CVE-2014-3568)
       * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

   Security Issues:

       * CVE-2014-3567
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
       * CVE-2014-3566
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
       * CVE-2014-3568
         <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Indications:

   Everybody should update.

Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11 SP3:

      zypper in -t patch sdksp3-libopenssl-devel-9915

   - SUSE Linux Enterprise Server 11 SP3 for VMware:

      zypper in -t patch slessp3-libopenssl-devel-9915

   - SUSE Linux Enterprise Server 11 SP3:

      zypper in -t patch slessp3-libopenssl-devel-9915

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-libopenssl-devel-9915

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):

      libopenssl-devel-0.9.8j-0.66.1

   - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

      libopenssl0_9_8-0.9.8j-0.66.1
      libopenssl0_9_8-hmac-0.9.8j-0.66.1
      openssl-0.9.8j-0.66.1
      openssl-doc-0.9.8j-0.66.1

   - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64):

      libopenssl0_9_8-32bit-0.9.8j-0.66.1
      libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1

   - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):

      libopenssl0_9_8-0.9.8j-0.66.1
      libopenssl0_9_8-hmac-0.9.8j-0.66.1
      openssl-0.9.8j-0.66.1
      openssl-doc-0.9.8j-0.66.1

   - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64):

      libopenssl0_9_8-32bit-0.9.8j-0.66.1
      libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1

   - SUSE Linux Enterprise Server 11 SP3 (ia64):

      libopenssl0_9_8-x86-0.9.8j-0.66.1

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

      libopenssl0_9_8-0.9.8j-0.66.1
      openssl-0.9.8j-0.66.1

   - SUSE Linux Enterprise Desktop 11 SP3 (x86_64):

      libopenssl0_9_8-32bit-0.9.8j-0.66.1


References:

   http://support.novell.com/security/cve/CVE-2014-3566.html
   http://support.novell.com/security/cve/CVE-2014-3567.html
   http://support.novell.com/security/cve/CVE-2014-3568.html
   https://bugzilla.suse.com/show_bug.cgi?id=892403
   https://bugzilla.suse.com/show_bug.cgi?id=901223
   https://bugzilla.suse.com/show_bug.cgi?id=901277
   http://download.suse.com/patch/finder/?keywords=e15c3470343095d331f7120ec6953c18

--
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

--
To unsubscribe, e-mail: [hidden email]
To contact the owner, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: AW: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL

Johannes Segitz
On Thu, Nov 06, 2014 at 06:51:00AM +0000, [hidden email] wrote:
> When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product.
>
> Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here:

It includes measures that can be used by applications to mitigate the
issue. You still need to use the workarounds.

Johannes
--
Johannes Segitz                                        SUSE Security Team
GPG Key E7C81FA0       EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
SUSE LINUX GmbH        Maxfeldstraße 5            90409 Nürnberg, Germany
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 21284 (AG Nürnberg)

signature.asc (853 bytes) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: AW: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL

Thomas Biege
In reply to this post by hans.paffrath
Hi,
nothing special here, yesterday we talked about openssl1 and the advisory mentioned below is an openssl 0.9 update for SLE11 which also contains the new SCSV feature. With this feature an application that uses it can detect downgrade attacks.
Still, your services should be configured to only use TLS.

HTH
Thomas


On November 6, 2014 7:51:00 AM CET, [hidden email] wrote:
Hello,

yesterday, you pronounced a patch for sle11 openssl1.

SUSE-SU-2014:1357-1

When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product.

Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here:

https://www.suse.com/support/kb/doc.php?id=7015773

Thanks.


Mit freundlichem Gruß
Hans Paffrath

Stadt Köln - Der Oberbürgermeister
Amt für Informationsverarbeitung
Willy-Brandt-Platz 3
50679 Köln

Telefon: 0221/221-26085
Telefax: 0221/221-22845
E-Mail: [hidden email]
Internet: www.stadt-koeln.de



-----Ursprüngliche Nachricht-----
Von: [hidden email] [mailto:[hidden email]]
Gesendet: Mittwoch, 5. November 2014 23:05
An: [hidden email]
Betreff: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL

SUSE Security Update: Security update for OpenSSL


Announcement ID: SUSE-SU-2014:1361-1
Rating: important
References: #892403 #901223 #901277
Cross-References: CVE-2014-3566 CVE-2014-3567 CVE-2014-3568

Affected Products:
SUSE Linux Enterprise Software Development Kit 11 SP3
SUSE Linux Enterprise Server 11 SP3 for VMware
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Desktop 11 SP3


An update that fixes three vulnerabilities is now availabl e.

Description:


This OpenSSL update fixes the following issues:

* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Indications:

Everybody should update.

Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Software Development Kit 11 SP3:

zypper in -t patch sdksp3-libopenssl-devel-9915

- SUSE Linux Enterprise Server 11 SP3 for VMware:

zypper in -t patch slessp3-libopenssl-devel-9915

- SUSE Linux Enterprise Server 11 SP3:

zypper in -t patch slessp3-libopenssl-devel-9915

- SUSE Linux Enterprise Desktop 11 SP3:

zypper in -t patch sledsp3-libopenssl-devel-9915

To bring your system up-to-date, use "zypper patch".


Package List:

- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):

libopenssl-devel-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

libopenssl0_9_8-0.9.8j-0.66.1
libopenssl0_9_8-hmac-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1
openssl-doc-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.66.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):

libopenssl0_9_8-0.9.8j-0.66.1
libopenssl0_9_8-hmac-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1
openssl-doc-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.66.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1

- SUSE Linux Enterprise Server 11 SP3 (ia64):

libopenssl0_9_8-x86-0.9.8j-0.66.1

- SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

libopenssl0_9_8-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1

- SUSE Linux Enterprise Desktop 11 SP3 (x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.66.1


References:

http://support.novell.com/security/cve/CVE-2014-3566.html
http://support.novell.com/security/cve/CVE-2014-3567.html
http://support.novell.com/security/cve/CVE-2014-3568.html
https://bugzilla.suse.com/show_bug.cgi?id=892403
https://bugzilla.suse.com/show_bug.cgi?id=901223
https://bugzilla.suse.com/show_bug.cgi?id=901277
http://download.suse.com/patch/finder/?keywords=e15c3470343095d331f7120ec6953c18

--
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

--
To unsubscribe, e-mail: [hidden email]
To contact the owner, e-mail: [hidden email]


--
Thomas Biege <[hidden email]>, Team Leader MaintenanceSecurity, CSSLP
SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB
21284 (AG Nürnberg)