OpenSSL ASN.1 Parsing Vulnerabilities
BID:8732
Info
OpenSSL ASN.1 Parsing Vulnerabilities
| Bugtraq ID: | 8732 |
| Class: | Unknown |
| CVE: |
CVE-2003-0543 CVE-2003-0544 CVE-2005-1730 CVE-2003-0545 |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 30 2003 12:00AM |
| Updated: | Jul 06 2016 02:32PM |
| Credit: | Discovery is credited to NISCC and Stephen Henson. |
| Vulnerable: |
VMWare GSX Server 2.5.1 build 5336 VMWare ESX Server 2.0 build 5257 VMWare ESX Server 1.5.2 Tarantella Enterprise 3 3.30 Tarantella Enterprise 3 3.20 0 Tarantella Enterprise 3 3.11 Tarantella Enterprise 3 3.10 Tarantella Enterprise 3 3.0 1 Tarantella Enterprise 3 3.0 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun ONE Web Server 6.0 SP6 Sun ONE Web Server 6.0 SP5 Sun ONE Web Server 6.0 SP4 Sun ONE Web Server 6.0 SP3 Sun ONE Web Server 6.0 SP2 Sun ONE Web Server 6.0 SP1 Sun ONE Web Server 6.0 Sun ONE Web Server 4.1 SP9 Sun ONE Web Server 4.1 SP8 Sun ONE Web Server 4.1 SP7 Sun ONE Web Server 4.1 SP6 Sun ONE Web Server 4.1 SP5 Sun ONE Web Server 4.1 SP4 Sun ONE Web Server 4.1 SP3 Sun ONE Web Server 4.1 SP2 Sun ONE Web Server 4.1 SP14 Sun ONE Web Server 4.1 SP13 Sun ONE Web Server 4.1 SP12 Sun ONE Web Server 4.1 SP11 Sun ONE Web Server 4.1 SP10 Sun ONE Web Server 4.1 SP1 Sun ONE Directory Server 5.1 x86 Sun ONE Directory Server 5.1 SP2 Sun ONE Directory Server 5.1 SP1 Sun ONE Directory Server 5.1 Sun ONE Application Server 7.0 UR2 Standard Edition Sun ONE Application Server 7.0 UR2 Platform Edition Sun ONE Application Server 7.0 UR1 Standard Edition Sun ONE Application Server 7.0 UR1 Platform Edition Sun ONE Application Server 7.0 Standard Edition Sun ONE Application Server 7.0 Platform Edition Sun Java System Web Server 6.1 Sun Grid Engine 5.3 x86 Sun Grid Engine 5.3 Sun Linux Sun Grid Engine 5.3 64-bit SPARC Sun Grid Engine 5.3 32-bit SPARC Sun Cluster 3.1 Sun Cluster 3.0 Stonesoft StoneGate 2.2.1 Stonesoft StoneGate 2.2 Stonesoft StoneGate 2.1 Stonesoft StoneGate 2.0.9 Stonesoft StoneGate 2.0.8 Stonesoft StoneGate 2.0.7 Stonesoft StoneGate 2.0.6 Stonesoft StoneGate 2.0.5 Stonesoft StoneGate 2.0.4 Stonesoft StoneGate 2.0.1 Stonesoft StoneGate 1.7.2 Stonesoft StoneGate 1.7.1 Stonesoft StoneGate 1.7 Stonesoft StoneGate 1.6.3 Stonesoft StoneGate 1.6.2 Stonesoft StoneGate 1.5.18 Stonesoft StoneGate 1.5.17 Stonesoft StoneBeat WebCluster 2.5 Stonesoft StoneBeat WebCluster 2.0 Stonesoft StoneBeat SecurityCluster 2.5 Stonesoft StoneBeat SecurityCluster 2.0 Stonesoft StoneBeat High Availability 3.1 Stonesoft StoneBeat FullCluster for Raptor 2.5 Stonesoft StoneBeat FullCluster for Raptor 2.0 Stonesoft StoneBeat FullCluster for ISA Server 3.0 Stonesoft StoneBeat FullCluster for Gauntlet 2.0 Stonesoft StoneBeat FullCluster for Firewall-1 3.0 Stonesoft StoneBeat FullCluster for Firewall-1 2.0 SSLeay SSLeay 0.9.1 SSLeay SSLeay 0.9 SSLeay SSLeay 0.8.1 SSLeay SSLeay 0.6.6 SSH Communications Security SSH2 3.2.5 SSH Communications Security SSH2 3.2.4 SSH Communications Security SSH2 3.2.3 SSH Communications Security SSH2 3.2.2 SSH Communications Security SSH2 3.2.1 SSH Communications Security SSH2 3.2 SSH Communications Security SSH2 3.1.8 SSH Communications Security SSH2 3.1.7 SSH Communications Security SSH2 3.1.6 SSH Communications Security SSH2 3.1.5 SSH Communications Security SSH2 3.1.4 SSH Communications Security SSH2 3.1.3 SSH Communications Security SSH2 3.1.2 SSH Communications Security SSH2 3.1.1 SSH Communications Security SSH2 3.1 SSH Communications Security SSH Sentinel 1.4 SSH Communications Security IPSEC Express Toolkit Snapgear Snapgear OS 1.8.4 SmoothWall GPL 1.0 SmoothWall Express 2.0 beta SGI ProPack 2.3 SGI ProPack 2.2.1 SGI IRIX 6.5.22 SGI IRIX 6.5.21 m SGI IRIX 6.5.21 f SGI IRIX 6.5.21 SGI IRIX 6.5.20 m SGI IRIX 6.5.20 f SGI IRIX 6.5.20 SGI IRIX 6.5.19 m SGI IRIX 6.5.19 f SGI IRIX 6.5.19 SCO Open Server 5.0.7 SCO Open Server 5.0.6 SCO Open Server 5.0.5 RedHat Linux 9.0 i386 Oracle Oracle9i Standard Edition 9.2 Oracle Oracle9i Standard Edition 9.0.1 Oracle Oracle9i Standard Edition 8.1.7 Oracle Oracle9i Personal Edition 9.2 Oracle Oracle9i Personal Edition 9.0.1 Oracle Oracle9i Personal Edition 8.1.7 Oracle Oracle9i Enterprise Edition 9.2 .0 Oracle Oracle9i Enterprise Edition 9.0.1 Oracle Oracle9i Enterprise Edition 8.1.7 Oracle Oracle9i Application Server 9.0.3 Oracle Oracle9i Application Server 9.0.2 Oracle Oracle9i Application Server 1.0.2 .2 Oracle Oracle9i Application Server 1.0.2 .1s Oracle Oracle HTTP Server 9.2 .0 Oracle Oracle HTTP Server 9.0.1 Oracle Oracle HTTP Server 8.1.7 OpenSSL Project OpenSSL 0.9.7 beta3 OpenSSL Project OpenSSL 0.9.7 beta2 OpenSSL Project OpenSSL 0.9.7 beta1 OpenSSL Project OpenSSL 0.9.7 b OpenSSL Project OpenSSL 0.9.7 a OpenSSL Project OpenSSL 0.9.7 OpenSSL Project OpenSSL 0.9.6 j OpenSSL Project OpenSSL 0.9.6 i OpenSSL Project OpenSSL 0.9.6 h OpenSSL Project OpenSSL 0.9.6 g OpenSSL Project OpenSSL 0.9.6 e OpenSSL Project OpenSSL 0.9.6 d OpenSSL Project OpenSSL 0.9.6 c OpenSSL Project OpenSSL 0.9.6 b OpenSSL Project OpenSSL 0.9.6 a OpenSSL Project OpenSSL 0.9.6 OpenSSL Project OpenSSL 0.9.5 a OpenBSD OpenBSD 3.4 OpenBSD OpenBSD 3.3 OpenBSD OpenBSD 3.2 OpenBSD OpenBSD 3.1 Novell Nsure Audit 1.0.1 Novell Netware 6.5 Novell Netware 6.0 Novell Netware 5.1 Novell NetMail 3.10 e Novell NetMail 3.10 d Novell NetMail 3.10 c Novell NetMail 3.10 b Novell NetMail 3.10 a Novell NetMail 3.10 Novell NetMail 3.1 Novell NetMail 3.0.3 b Novell NetMail 3.0.3 a Novell NetMail 3.0.3 Novell NetMail 3.0.1 Novell International Cryptographic Infostructure (NICI) 2.6.1 Novell iManager 2.0.2 Novell iManager 2.0 Novell iManager 1.5 Novell iChain Server 2.2 SP1 Novell iChain Server 2.2 FP1a Novell iChain Server 2.2 FP1 Novell iChain Server 2.2 Novell GroupWise WebAccess 6.5 SP2 Novell GroupWise WebAccess 6.5 SP1 Novell GroupWise WebAccess 6.5 Novell GroupWise WebAccess 6.0 SP4 Novell GroupWise Internet Agent 6.5.1 Novell Groupwise 6.5 SP2 Novell Groupwise 6.0 SP4 Novell eDirectory 8.7.1 SU1 Novell eDirectory 8.7.1 Novell eDirectory 8.7 Novell eDirectory 8.6.2 Novell eDirectory 8.5.27 Novell eDirectory 8.5.12 a Novell eDirectory 8.5 Novell eDirectory 8.0 Novell BorderManager 3.8 Mandriva Linux Mandrake 9.2 Mandriva Linux Mandrake 9.1 ppc Mandriva Linux Mandrake 9.1 Mandriva Linux Mandrake 9.0 Mandriva Linux Mandrake 8.2 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 2.1 x86_64 MandrakeSoft Corporate Server 2.1 Juniper Networks T-series Router T640 Juniper Networks T-series Router T320 Juniper Networks SDX-300 3.1.1 Juniper Networks SDX-300 3.1 Juniper Networks M-series Router M5 Juniper Networks M-series Router M40e Juniper Networks M-series Router M40 Juniper Networks M-series Router M20 Juniper Networks M-series Router M160 Juniper Networks M-series Router M10 Ingate SIParator 3.2.1 Ingate SIParator 3.2 Ingate Firewall 3.2.1 Ingate Firewall 3.2 IBM Rational Rose 2000 IBM HTTP Server 2.0.47 IBM HTTP Server 2.0.42 .2 IBM HTTP Server 2.0.42 IBM HTTP Server 1.3.28 IBM HTTP Server 1.3.26 IBM HTTP Server 1.3.19 IBM HTTP Server 1.3.12 .4 IBM HTTP Server 1.3.12 .3 IBM HTTP Server 1.3.12 .2 HP HP-UX AAA Server A.06.01.02 HP HP-UX 11.23 HP HP-UX 11.22 HP HP-UX 11.20 HP HP-UX 11.11 HP HP-UX 11.0 HP HP WBEM Services for HP-UX A.01.05.05 F5 ISMan F5 FirePass F5 BigIP 4.5 F5 BigIP 4.4 F5 BigIP 4.3 F5 BigIP 4.2 F5 BigIP 2.1 F5 BigIP 2.0 F5 3-DNS 4.5 F5 3-DNS 4.4 F5 3-DNS 4.3 F5 3-DNS 4.2 F-Secure SSH 5.3 For Windows F-Secure SSH 5.2 For Windows F-Secure SSH 5.1 For Windows F-Secure SSH 3.2.3 For UNIX F-Secure SSH 3.2 .0 For UNIX F-Secure SSH 3.1 .0 For UNIX F-Secure SSH 3.1 .0 F-Secure SSH 3.0.1 For UNIX Cray Cray Open Software 3.4 Computer Associates eTrust Security Command Center 1.0 Cisco Threat Response Cisco SN 5428 Storage Router SN5428-3.3.2-K9 Cisco SN 5428 Storage Router SN5428-3.3.1-K9 Cisco SN 5428 Storage Router SN5428-3.2.2-K9 Cisco SN 5428 Storage Router SN5428-3.2.1-K9 Cisco SN 5428 Storage Router SN5428-2.5.1-K9 Cisco SN 5428 Storage Router SN5428-2-3.3.2-K9 Cisco SN 5428 Storage Router SN5428-2-3.3.1-K9 Cisco SIP Proxy Server Cisco Secure Policy Manager 3.0.1 Cisco PIX Firewall 520 Cisco PIX Firewall 515 Cisco Network Analysis Module 0 Cisco IOS 12.2SY Cisco IOS 12.2SX Cisco IOS 12.1(19)E Cisco IOS 12.1(13.4)E Cisco IOS 12.1(11b)E Cisco IOS 12.1(11)E Cisco GSS 4480 Global Site Selector Cisco Firewall Services Module (FWSM) 0 Cisco CSS11000 Content Services Switch Cisco CSS Secure Content Accelerator 2.0 Cisco CSS Secure Content Accelerator 1.0 Cisco CiscoWorks Common Services 2.2 Cisco CiscoWorks 1105 Wireless LAN Solution Engine Cisco CiscoWorks 1105 Hosting Solution Engine Cisco Application & Content Networking Software Check Point Software VPN-1 4.1 SP4 Check Point Software VPN-1 4.1 SP3 Check Point Software VPN-1 4.1 SP2 Check Point Software VPN-1 4.1 SP1 Check Point Software VPN-1 4.1 Check Point Software Providor-1 4.1 SP4 Check Point Software Providor-1 4.1 SP3 Check Point Software Providor-1 4.1 SP2 Check Point Software Providor-1 4.1 SP1 Check Point Software Providor-1 4.1 Check Point Software Nokia Voyager 4.1 Check Point Software Next Generation FP3 HF2 Check Point Software Next Generation FP3 HF1 Check Point Software Next Generation FP3 Check Point Software Next Generation FP2 Check Point Software Next Generation FP1 Check Point Software Firewall-1 4.1 SP6 Check Point Software Firewall-1 4.1 SP5 Check Point Software Firewall-1 4.1 SP4 Check Point Software Firewall-1 4.1 SP3 Check Point Software Firewall-1 4.1 SP2 Check Point Software Firewall-1 4.1 SP1 Check Point Software Firewall-1 4.1 Check Point Software Firewall-1 4.0 SP8 Check Point Software Firewall-1 4.0 SP7 Check Point Software Firewall-1 4.0 SP6 Check Point Software Firewall-1 4.0 SP5 Check Point Software Firewall-1 4.0 SP4 Check Point Software Firewall-1 4.0 SP3 Check Point Software Firewall-1 4.0 SP2 Check Point Software Firewall-1 4.0 SP1 Check Point Software Firewall-1 4.0 Check Point Software Firewall-1 3.0 BorderWare Firewall Server 7.0 Blue Coat Systems Security Gateway OS 3.0 Blue Coat Systems Security Gateway OS 2.0 Blue Coat Systems CacheOS CA/SA 4.1.10 Apple Mac OS X Server 10.2.7 Apple Mac OS X Server 10.2.6 Apple Mac OS X Server 10.2.5 Apple Mac OS X Server 10.2.4 Apple Mac OS X Server 10.2.3 Apple Mac OS X Server 10.2.2 Apple Mac OS X Server 10.2.1 Apple Mac OS X Server 10.2 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 |
| Not Vulnerable: |
Tarantella Enterprise 3 3.40 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun ONE Web Server 6.0 SP7 Sun ONE Web Server 4.1 SP14 Sun ONE Directory Server 5.1 SP3 Sun ONE Application Server 7.0 UR2 Upgrade Standard Sun ONE Application Server 7.0 UR2 Upgrade Platform Sun Java System Web Server 6.1 SP1 Sun Cluster 2.2 Sun Cluster 2.1 SSH Communications Security SSH2 3.2.9 SSH Communications Security SSH Sentinel 1.4.1 Snapgear Snapgear OS 1.8.5 OpenSSL Project OpenSSL 0.9.7 c OpenSSL Project OpenSSL 0.9.6 k Novell Nsure Audit 1.0.3 Novell Nsure Audit 1.0.2 Novell NetMail 3.1 f Novell iManager 2.5 Novell eDirectory 8.7.1 SU1 Ingate SIParator 3.3.1 Ingate Firewall 3.3.1 IBM Rational RequisitePro 7.0 HP HP-UX AAA Server A.06.01.02.04 HP HP WBEM Services for HP-UX A.01.05.07 Apple Mac OS X Server 10.2.8 Apple Mac OS X 10.2.8 |
Discussion
OpenSSL ASN.1 Parsing Vulnerabilities
Multiple vulnerabilities were reported in the ASN.1 parsing code in OpenSSL. Attackers could exploit these issues to cause a denial of service or to execute arbitrary code.
Multiple vulnerabilities were reported in the ASN.1 parsing code in OpenSSL. Attackers could exploit these issues to cause a denial of service or to execute arbitrary code.
Exploit / POC
OpenSSL ASN.1 Parsing Vulnerabilities
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept brute-force exploit has been supplied by Bram Matthys (Syzop):
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept brute-force exploit has been supplied by Bram Matthys (Syzop):
Solution / Fix
OpenSSL ASN.1 Parsing Vulnerabilities
Solution:
Please see the referenced advisories for more information.
HP HP-UX AAA Server A.06.01.02
OpenSSL Project OpenSSL 0.9.6 d
OpenSSL Project OpenSSL 0.9.6 a
OpenSSL Project OpenSSL 0.9.7 beta1
OpenSSL Project OpenSSL 0.9.7 a
SSH Communications Security SSH Sentinel 1.4
Novell iManager 2.0
IBM HTTP Server 2.0.42
Novell NetMail 3.0.1
Novell NetMail 3.0.3 a
SSH Communications Security SSH2 3.1.4
SSH Communications Security SSH2 3.1.6
Novell NetMail 3.10 e
Ingate Firewall 3.2.1
SSH Communications Security SSH2 3.2.2
Sun ONE Directory Server 5.1
Sun Grid Engine 5.3 x86
SGI IRIX 6.5.20 f
SGI IRIX 6.5.20 m
SGI IRIX 6.5.21 m
Mandriva Linux Mandrake 9.1
Solution:
Please see the referenced advisories for more information.
HP HP-UX AAA Server A.06.01.02
-
HP HP-UX AAA Server A.06.01.02.04
ftp://acubed:[email protected]/
OpenSSL Project OpenSSL 0.9.6 d
-
OpenSSL Project OpenSSL 0.9.6k
http://www.openssl.org/source/ -
Slackware openssl-0.9.6k-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/o penssl-0.9.6k-i386-1.tgz -
Slackware openssl-solibs-0.9.6k-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/o penssl-solibs-0.9.6k-i386-1.tgz
OpenSSL Project OpenSSL 0.9.6 a
-
Conectiva openssl-0.9.6a-3U70_7cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-0.9.6a-3U70_7cl.i 386.rpm -
Conectiva openssl-devel-0.9.6a-3U70_7cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-devel-0.9.6a-3U70 _7cl.i386.rpm -
Conectiva openssl-devel-static-0.9.6a-3U70_7cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-devel-static-0.9. 6a-3U70_7cl.i386.rpm -
Conectiva openssl-progs-0.9.6a-3U70_7cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/openssl-progs-0.9.6a-3U70 _7cl.i386.rpm -
OpenSSL Project OpenSSL 0.9.6k
http://www.openssl.org/source/ -
S.u.S.E. openssl-0.9.6a-83.i386.rpm
Upgrade for Intel i386 Platform, SuSE-7.2.
ftp://ftp.suse.com/pub/suse/i386/update/7.2/sec1/openssl-0.9.6a-83.i38 6.rpm -
S.u.S.E. openssl-devel-0.9.6a-83.i386.rpm
openssl-devel: Upgrade for Intel i386 Platform, SuSE-7.2.
ftp://ftp.suse.com/pub/suse/i386/update/7.2/d2/openssl-devel-0.9.6a-83 .i386.rpm -
S.u.S.E. openssl-doc-0.9.6a-83.i386.rpm
openssl-doc: Upgrade for Intel i386 Platform, SuSE-7.2.
ftp://ftp.suse.com/pub/suse/i386/update/7.2/doc3/openssl-doc-0.9.6a-83 .i386.rpm
OpenSSL Project OpenSSL 0.9.7 beta1
-
OpenSSL Project OpenSSL 0.9.7c
http://www.openssl.org/source/
OpenSSL Project OpenSSL 0.9.7 a
-
Conectiva openssl-devel-0.9.7a-28910U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl-devel-0.9.7a-28910U 90_1cl.i386.rpm -
Conectiva openssl-devel-static-0.9.7a-28910U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl-devel-static-0.9.7a -28910U90_1cl.i386.rpm -
Conectiva openssl-progs-0.9.7a-28910U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl-progs-0.9.7a-28910U 90_1cl.i386.rpm -
Conectiva openssl0.9.7-0.9.7a-28910U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/openssl0.9.7-0.9.7a-28910U9 0_1cl.i386.rpm -
OpenSSL Project OpenSSL 0.9.7c
http://www.openssl.org/source/ -
Red Hat openssl-0.9.7a-20.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/openssl-0.9.7a-20.i386.rpm -
Red Hat openssl-0.9.7a-20.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/openssl-0.9.7a-20.i686.rpm -
Red Hat openssl-devel-0.9.7a-20.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/openssl-devel-0.9.7a-20.i386.rpm -
Red Hat openssl-perl-0.9.7a-20.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/openssl-perl-0.9.7a-20.i386.rpm -
Slackware openssl-0.9.7c-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/o penssl-0.9.7c-i386-1.tgz -
Slackware openssl-solibs-0.9.7c-i386-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/o penssl-solibs-0.9.7c-i386-1.tgz
SSH Communications Security SSH Sentinel 1.4
-
SSH Communications Security SSH Sentinel 1.4.1
SSH Sentinel upgrade requires a valid license for SSH Sentinel 1.4.
http://ftp.ssh.com/priv/sentinel/9h86876tiu/SSHSentinel1.4.1.98_no_lic ense.exe
Novell iManager 2.0
-
Novell iManager 2.5
http://download.novell.com/Download?buildid=Hoj260Hi4k8~
IBM HTTP Server 2.0.42
Novell NetMail 3.0.1
-
Novell netmail310f.exe
For Microsoft Windows
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.exe -
Novell netmail310f.tgz
For Linux
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.tgz -
Novell netmail310f.zip
For NetWare
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.zip
Novell NetMail 3.0.3 a
-
Novell netmail310f.exe
For Microsoft Windows
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.exe -
Novell netmail310f.tgz
For Linux
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.tgz -
Novell netmail310f.zip
For NetWare
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.zip
SSH Communications Security SSH2 3.1.4
-
SSH Communications Security SSH Secure Shell for Servers 3.2.9
http://www.ssh.com/support/downloads/secureshellserver/updates-and-pac kages-3-2.html -
SSH Communications Security SSH Secure Shell for Windows Servers 3.2.9
http://www.ssh.com/support/downloads/secureshellwinserver/updates-and- packages-3-2.html -
SSH Communications Security SSH Secure Shell for Workstations 3.2.9
http://www.ssh.com/support/downloads/secureshellwks/updates-and-packag es-3-2.html
SSH Communications Security SSH2 3.1.6
-
SSH Communications Security SSH Secure Shell for Servers 3.2.9
http://www.ssh.com/support/downloads/secureshellserver/updates-and-pac kages-3-2.html -
SSH Communications Security SSH Secure Shell for Windows Servers 3.2.9
http://www.ssh.com/support/downloads/secureshellwinserver/updates-and- packages-3-2.html -
SSH Communications Security SSH Secure Shell for Workstations 3.2.9
http://www.ssh.com/support/downloads/secureshellwks/updates-and-packag es-3-2.html
Novell NetMail 3.10 e
-
Novell netmail310f.exe
For Microsoft Windows
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.exe -
Novell netmail310f.tgz
For Linux
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.tgz -
Novell netmail310f.zip
For NetWare
http://support.novell.com/servlet/filedownload/sec/pub/netmail310f.zip
Ingate Firewall 3.2.1
-
Ingate Firewall 3.3.1
http://www.ingate.com/upgrades.php
SSH Communications Security SSH2 3.2.2
-
SSH Communications Security SSH Secure Shell for Servers 3.2.9
http://www.ssh.com/support/downloads/secureshellserver/updates-and-pac kages-3-2.html -
SSH Communications Security SSH Secure Shell for Windows Servers 3.2.9
http://www.ssh.com/support/downloads/secureshellwinserver/updates-and- packages-3-2.html -
SSH Communications Security SSH Secure Shell for Workstations 3.2.9
http://www.ssh.com/support/downloads/secureshellwks/updates-and-packag es-3-2.html
Sun ONE Directory Server 5.1
Sun Grid Engine 5.3 x86
-
Sun 116658-01
http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116658&rev=01 -
Sun 116659-01
NON-Solaris Package format
http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=116659&rev=01
SGI IRIX 6.5.20 f
-
SGI openssl.tardist
ftp://patches.sgi.com/support/free/security/patches/6.5.22/openssl.tar dist -
SGI patch5405.tar
ftp://patches.sgi.com/support/free/security/patches/6.5.20/patch5405.t ar
SGI IRIX 6.5.20 m
-
SGI openssl.tardist
ftp://patches.sgi.com/support/free/security/patches/6.5.22/openssl.tar dist -
SGI patch5405.tar
ftp://patches.sgi.com/support/free/security/patches/6.5.20/patch5405.t ar
SGI IRIX 6.5.21 m
-
SGI openssl.tardist
ftp://patches.sgi.com/support/free/security/patches/6.5.22/openssl.tar dist -
SGI patch5363.tar
ftp://patches.sgi.com/support/free/security/patches/6.5.21/patch5363.t ar
Mandriva Linux Mandrake 9.1
-
Mandrake libopenssl0-0.9.6i-1.2.91mdk.i586.rpm
Mandrake Linux 9.1FTP Folder: 9.1/RPMS/
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-0.9.7a-1.2.91mdk.i586.rpm
Mandrake Linux 9.1FTP Folder: 9.1/RPMS/
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-devel-0.9.7a-1.2.91mdk.i586.rpm
Mandrake Linux 9.1FTP Folder: 9.1/RPMS/
http://www.mandrakesecure.net/en/ftp.php -
Mandrake libopenssl0.9.7-static-devel-0.9.7a-1.2.91mdk.i586.rpm
Mandrake Linux 9.1FTP Folder: 9.1/RPMS/
http://www.mandrakesecure.net/en/ftp.php -
Mandrake openssl-0.9.7a-1.2.91mdk.i586.rpm
Mandrake Linux 9.1FTP Folder: 9.1/RPMS/
http://www.mandrakesecure.net/en/ftp.php
References
OpenSSL ASN.1 Parsing Vulnerabilities
References:
References:
- A vulnerability has been discovered in F-Secure SSH in the way it handles digita (F-Secure)
- A vulnerability in F-Secure SSH's way to handles digital certificates (F-Secure)
- Alert ID: 57599 (Sun)
- Apple Security Updates (Apple)
- Apple Software Downloads (Apple)
- CERT Advisory CA-2003-26 Multiple Vulnerabilities in SSL/TLS Implementations (CERT/CC)
- Cisco Security Advisory: SSL Implementation Vulnerabilities (Cisco)
- eDirectory TID10087450 (Novell) (Novell)
- eDirectory TID2967586 (Novell)
- eDirectory TID2968007 (Novell) (Novell)
- ESX OpenSSL updates (VMware)
- Field Test File for GW6 SP4 NLM & Win Agents - TID2967420 (Novell)
- Field Test File GW 6.5 SP2 NLM/Win Agents - TID2967421 (Novell)
- Firewall Server Home Page (BorderWare)
- FTF: GroupWise 6 Internet Agent SP4 rev G - TID2967425 (Novell)
- FTF: GroupWise 6 SP4 WebAccess Revision F - TID2967411 (Novell)
- FTF: GroupWise 6.5 SP2 WebAccess Revision B - TID2967408 (Novell)
- FTF:GroupWise 6.5.1 Internet Agent Rev E - TID2967399 (Novell)
- GSX OpenSSL updates (VMware)
- iChain 2.2 Support Pack 2 beta - TID2967175 (Novell)
- MDKSA-2003:098 : openssl (Mandrake)
- MSS-OAR-E01-2004.0422.1 (IBM)
- NetMail 3.1f Update for Linux - TID2967210 (Novell)
- NetMail 3.1f Update for NetWare - TID2967209 (Novell)
- NetMail 3.1f Update for Windows - TID2967208 (Novell)
- NISCC Vulnerability Advisory 006489/OpenSSL (NISCC)
- NISCC vulnerability advisory on SSL (secure sockets layer) and TLS (transport (Novell)
- Novell iManager 2.0.2 ASN.1 Parsing vulnerability in Apache module (CIRT)
- Novell Nsure Audit 1.0.1 (Win32 version) - CIRT-31 (CIRT)
- OpenSSL Security Advisory [30 September 2003] (OpenBSD)
- OpenSSL security bugs (Stonesoft)
- Oracle Support Metalink (Oracle)
- Patches Now Available For SmoothWall GPL 1.0, 2.0b6 "voyager" (SmoothWall)
- Regarding NISCC vulnerability advisory on SSL and TLS - TID10087450 (Novell)
- Release notice for Ingate Firewall 3.3.1 and Ingate SIParator 3.3.1 (InGate)
- RHSA-2003-293 (Red Hat)
- Security Advisory: OpenSSL Vulnerability (Blue Coat Systems)
- Security Alerts (Novell)
- Security Update 4 - TID2968981 (Novell)
- SSH IPSec Toolkit Security Bugs (Stonesoft)
- SSH Secure Shell Security Vulnerability in BER Decoding (SSH Communications Security)
- SSH Sentinel Security Vulnerability in BER Decoding (SSH Communications Security)
- SSL Update for CERT CA200326 and older SSL issues (Oracle)
- Sun Alert ID: 57100 (Sun Microsystems)
- Sun Alert ID: 57444 (Sun)
- Sun Alert ID: 57472 (Sun)
- Sun Alert ID: 57475 (Sun)
- Sun Alert ID: 57498 (Sun)
- Sun Linux Support - Sun Linux Patches (Sun)
- Tarantella Security Bulletin #08 (Tarantella)
- TID10097379 - Security Vulnerability against webadmin.exe (Novell)
- Vendor Home Page (BorderWare)
- Vulnerabilities in ASN.1 parsing (OpenSSL)
- Vulnerability Detected: 170.23.146.40:443 - OpenSSL Overflow Via Invalid Certifi (IBM)
- Vulnerability Note VU#255484 (CERT/CC)
- Vulnerability Note VU#380864 (CERT/CC)
- Vulnerability Note VU#686224 (CERT/CC)
- Vulnerability Note VU#732952 (CERT/CC)
- Vulnerability Note VU#935264 (CERT/CC)
- VMware GSX Server and ESX Server OpenSSL vulnerability patches (VMware