Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 415435 (CVE-2012-2333) - <dev-libs/openssl-{0.9.8x,1.0.0j}: Invalid TLS/DTLS record attack (CVE-2012-2333)
Summary: <dev-libs/openssl-{0.9.8x,1.0.0j}: Invalid TLS/DTLS record attack (CVE-2012-2...
Status: RESOLVED FIXED
Alias: CVE-2012-2333
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://www.openssl.org/news/secadv_2...
Whiteboard: A3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2012-05-10 23:42 UTC by Tim Sammut (RETIRED)
Modified: 2013-12-03 04:27 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tim Sammut (RETIRED) gentoo-dev 2012-05-10 23:42:15 UTC
From the upstream advisory at $URL:

OpenSSL Security Advisory [10 May 2012]
=======================================

Invalid TLS/DTLS record attack (CVE-2012-2333)
===============================================

A flaw in the OpenSSL handling of CBC mode ciphersuites in TLS 1.1, 1.2 and
DTLS can be exploited in a denial of service attack on both clients and
servers.

DTLS applications are affected in all versions of OpenSSL. TLS is only
affected in OpenSSL 1.0.1 and later.

Thanks to Codenomicon for discovering this issue using Fuzz-o-Matic fuzzing
as a service testing platform.

The fix was developed by Stephen Henson of the OpenSSL core team.

Affected users should upgrade to OpenSSL 1.0.1c, 1.0.0j or 0.9.8x

References
==========

URL for this Security Advisory:
http://www.openssl.org/news/secadv_20120510.txt
Comment 1 SpanKY gentoo-dev 2012-05-11 00:22:42 UTC
already in the tree
Comment 2 Tim Sammut (RETIRED) gentoo-dev 2012-05-11 01:01:48 UTC
okiedokiethanks.

Arches, please test and mark stable:
=dev-libs/openssl-1.0.0j
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"

=dev-libs/openssl-0.9.8x
Target keywords : "amd64 x86"
Comment 3 Jeff (JD) Horelick (RETIRED) gentoo-dev 2012-05-11 07:37:06 UTC
x86 stable
Comment 4 Tobias Klausmann gentoo-dev 2012-05-12 11:40:14 UTC
Stable on alpha.
Comment 5 Jeroen Roovers gentoo-dev 2012-05-12 16:04:48 UTC
Stable for HPPA.
Comment 6 Raúl Porcel (RETIRED) gentoo-dev 2012-05-12 16:37:30 UTC
arm/ia64/m68k/s390/sh/sparc stable
Comment 7 Agostino Sarubbo gentoo-dev 2012-05-13 11:14:01 UTC
amd64 stable
Comment 8 Mark Loeser (RETIRED) gentoo-dev 2012-05-13 19:52:17 UTC
ppc/ppc64 done
Comment 9 Tim Sammut (RETIRED) gentoo-dev 2012-05-14 01:03:48 UTC
Thanks, everyone. Added to existing GLSA request.
Comment 10 GLSAMaker/CVETool Bot gentoo-dev 2012-05-16 00:59:07 UTC
CVE-2012-2333 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2333):
  Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1
  before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption,
  allows remote attackers to cause a denial of service (buffer over-read) or
  possibly have unspecified other impact via a crafted TLS packet that is not
  properly handled during a certain explicit IV calculation.
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2013-12-03 04:27:47 UTC
This issue was resolved and addressed in
 GLSA 201312-03 at http://security.gentoo.org/glsa/glsa-201312-03.xml
by GLSA coordinator Chris Reffett (creffett).