Yellow Dog Linux Security Announcement
--------------------------------------
Package:	openssl
Issue Date:	Apr 23,2003   
Priority:	medium
Advisory ID: 	YDU-20030423-4


1. 	Topic:

	Updated OpenSSL packages are available.


2. 	Problem:
	
	"Updated OpenSSL packages are available that fix a potential
	timing-based attack and a modified Bleichenbacher attack.

	OpenSSL is a commercial-grade, full-featured, and open source toolkit
	that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer
	Security (TLS v1) protocols as well as a full-strength general purpose
	cryptography library.

	Researchers discovered a timing attack on RSA keys. Applications
	making use of OpenSSL are generally vulnerable to such an attack, unless RSA
	blinding has been turned on. OpenSSL does not use RSA blinding by
	default and most applications do not enable RSA blinding.

	A local or remote attacker could use this attack to obtain the
	server's private key by determining factors using timing differences on (1) the
	number of extra reductions during Montgomery reduction, and (2) the
	use of different integer multiplication algorithms ("Karatsuba" and normal).

	In order for an attack to be sucessful, an attacker must have good
	network conditions that allow small changes in timing to be reliably
	observed.

	Additionally, the SSL and TLS components for OpenSSL allow remote
	attackers to perform an unauthorized RSA private key operation via a modified
	Bleichenbacher attack. This attack uses a large number of SSL or TLS
	connections, using PKCS #1 v1.5 padding, and causes OpenSSL to leak
	information regarding the relationship between ciphertext and the
	associated plaintext, aka the "Klima-Pokorny-Rosa attack."

	These erratum packages contain a patch provided by the OpenSSL group
	that enables RSA blinding by default and protects against the
	"Klima-Pokorny-Rosa attack."

	Because server applications are affected by these vulnerabilities,
	users are advised to restart all services that use OpenSSL functionality or
	reboot their systems after installing these updates."

	(From Red Hat Advisory)
	

3. 	Solution:

   	a) Updating via apt...
   	We suggest that you use the apt-get program to keep your
   	system up-to-date. The following command(s) will retrieve
   	and install the fixed version of this update onto your system:

		apt-get openssl
		apt-get install openssl

   	b) Updating manually...
	Download the updates below and then run the following rpm command.
   	(Please use a mirror site)

		rpm -Fvh [filenames]
		Yellow Dog Linux 3.0
		ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/
			ppc/openssl096-0.9.6-17.ppc.rpm
			ppc/openssl096b-0.9.6b-6a.ppc.rpm
			ppc/openssl-0.9.7a-5a.ppc.rpm
			ppc/openssl-devel-0.9.7a-5a.ppc.rpm
			ppc/openssl-perl-0.9.7a-5a.ppc.rpm
			

4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
[Yellow Dog Linux 3.0]
d7e51211da6caf342807c06de781163d  SRPMS/openssl096-0.9.6-17.src.rpm
81ffb7e7446127e360b5e15b3406e75c  SRPMS/openssl096b-0.9.6b-6a.src.rpm
93d3e480763dd581e1af169911ab092f  SRPMS/openssl-0.9.7a-5a.src.rpm
bf7ab0ee0001360626da82453191fba1  ppc/openssl096-0.9.6-17.ppc.rpm
305e0e0b9ef0bf03fa6fdc78c58dec4a  ppc/openssl096b-0.9.6b-6a.ppc.rpm
ad5561b913b30c1ba3d09526dd85310e  ppc/openssl-0.9.7a-5a.ppc.rpm
aaf4e093d894bfb142cb57b7fa6a60fa  ppc/openssl-devel-0.9.7a-5a.ppc.rpm
adcdcb5ff879f0a4e90569822bd9420b  ppc/openssl-perl-0.9.7a-5a.ppc.rpm


If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: md5sum <filename>


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.terrasoftsolutions.com/ for more
information.

For information regarding the usage of apt-get, see:
http://www.yellowdoglinux.com/support/solutions/ydl_general/apt-get.shtml