Packet Storm

Mandriva Linux Security Advisory 2010-076: Posted Apr 20, 2010; Authored by Mandriva | Site mandriva.com; Mandriva Linux Security Advisory 2010-076 - The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection. OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls which has unspecified impact and context-dependent attack vectors. The kssl_keytab_is_available function in ssl/kssl.c in OpenSSL before 0.9.8n, when Kerberos is enabled but Kerberos configuration files cannot be opened, could allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash). Finally, this update provides support for secure renegotiation, preventing men-in-the-middle attacks. Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products. Packages for 2009.0 are provided due to the Extended Maintenance Program.; tags | advisory, remote, denial of service; systems | linux, mandriva; advisories | CVE-2009-3555, CVE-2009-3245, CVE-2010-0740, CVE-2010-0433; SHA-256 | 11172d56889cc352548682b796e598baf6508870d7731f05c4647b445fbd3c72; Download | Favorite | View

Related Files

No related files