5181418 2000-06-10 06:29 /113 rader/ Postmaster
Mottagare: Bugtraq (import) <11231>
Ärende: Security Update: flaws in the SSL transaction handling of Netscape
------------------------------------------------------------
Approved-By: aleph1@SECURITYFOCUS.COM
Delivered-To: bugtraq@lists.securityfocus.com
Delivered-To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-ID: <20000609120113.A32719@phoenix.calderasystems.com>
Date: Fri, 9 Jun 2000 12:01:13 -0600
Reply-To: Technical Support <support@PHOENIX.CALDERASYSTEMS.COM>
Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
From: Technical Support <support@PHOENIX.CALDERASYSTEMS.COM>
X-To: announce@lists.calderasystems.com, linux-security@redhat.com
To: BUGTRAQ@SECURITYFOCUS.COM
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
Caldera Systems, Inc. Security Advisory
Subject: flaws in the SSL transaction handling of Netscape
Advisory number: CSSA-2000-017.0
Issue date: 2000 June, 09
Cross reference:
______________________________________________________________________________
1. Problem Description
There are some flaws in the SSL transaction handling of Netscape
Version 4.72 which could compromise encrypted SSL sessions.
This update upgrades Netscape to version 4.73, which also fixes
some annoying crashes during common usage.
Upgrade to the new version is recommended.
2. Vulnerable Versions
System Package
-----------------------------------------------------------
OpenLinux Desktop 2.3 not vulnerable
OpenLinux eServer 2.3 not vulnerable
and OpenLinux eBuilder
OpenLinux eDesktop 2.4 previous to communicator-4.73-2
3. Solution
Workaround:
none
The proper solution is to upgrade to the fixed packages.
4. OpenLinux Desktop 2.3
not vulnerable
5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0
not vulnerable
6. OpenLinux eDesktop 2.4
6.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS
6.2 Verification
9ecb1ce4bc3725e83547508d668c96ce RPMS/communicator-4.73-2.i386.rpm
6693cb054149d0d59c3adea89913052b SRPMS/communicator-4.73-2.src.rpm
6.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -F communicator-4.73-2.i386.rpm
7. References
This and other Caldera security resources are located at:
http://www.calderasystems.com/support/security/index.html
8. Disclaimer
Caldera Systems, Inc. is not responsible for the misuse of any of
the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera
OpenLinux.
9. Acknowledgements
Caldera Systems wishes to thank Netscape and SuSE for providing
fixes
for the encountered crashes and security problems.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE5QN3H18sy83A/qfwRAnKNAKCbmDwTAIDpb9aHiAcB5/q2Y62kwgCdFeDI
HPYcm2eBLiFmg907sCh0jeY=
=mzDh
-----END PGP SIGNATURE-----
(5181418) ------------------------------------------(Ombruten)