[OpenPKG-SA-2006.018] OpenPKG Security Advisory (openssl)

[OpenPKG <openpkg () openpkg org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory                            The OpenPKG Project
http://www.openpkg.org/security/                  http://www.openpkg.org
openpkg-security () openpkg org                         openpkg () openpkg org
OpenPKG-SA-2006.018                                          06-Sep-2006
________________________________________________________________________

Package:             openssl
Vulnerability:       signature verification failure
OpenPKG Specific:    no

Affected Releases:   Affected Packages:           Corrected Packages:
OpenPKG CURRENT      <= openssl-0.9.8b-20060505   >= openssl-0.9.8c-20060905
OpenPKG 2-STABLE     <= openssl-0.9.8b-2.20060622 >= openssl-0.9.8c-2.20060906
OpenPKG 2.5-RELEASE  <= openssl-0.9.8a-2.5.1      >= openssl-0.9.8a-2.5.2

Description:
  According to a vendor security advisory [0], Daniel Bleichenbacher
  described a possible attack on PKCS #1 v1.5 signatures which affects
  the cryptography and SSL/TLS toolkit OpenSSL [1].
  
  If an RSA key with exponent 3 is used it may be possible to forge
  a PKCS #1 v1.5 signature signed by that key. Implementations may
  incorrectly verify the certificate if they are not checking for excess
  data in the RSA exponentiation result of the signature. Since there
  are CAs using exponent 3 in wide use, and PKCS #1 v1.5 is used in
  X.509 certificates, all software that uses OpenSSL to verify X.509
  certificates is potentially vulnerable, as well as any other use of
  PKCS #1 v1.5. This includes software that uses OpenSSL for SSL or TLS.

  The Common Vulnerabilities and Exposures (CVE) project assigned the id
  CVE-2006-4339 [2] to the problem.
________________________________________________________________________

References:
  [0] http://www.openssl.org/news/secadv_20060905.txt 
  [1] http://www.openssl.org/
  [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4339
________________________________________________________________________

For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <openpkg () openpkg org>" (ID 63C4CB9F) of the
OpenPKG project which you can retrieve from http://pgp.openpkg.org and
hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org
for details on how to verify the integrity of this advisory.
________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG <openpkg () openpkg org>

iD8DBQFE/o9xgHWT4GPEy58RAn09AJ0RvSOCTihCxY4vWJdKsh9a/tpr5ACggXBe
dEOgfhj33twaWWmWa0T7zio=
=zkpQ
-----END PGP SIGNATURE-----