Red Hat Security Advisory: openssl, mm, mod_ssl security update for Stronghold
A new Stronghold 3 release is available which fixes several serious buffer overflow vulnerabilities in OpenSSL, and local privilege escalation vulnerabilities in MM and mod_ssl.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2002-0655US | high7.5 | — | ||
OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, does not properly handle ASCII representations of integers on 64 bit platforms, which could allow attackers to cause a deni… | ||||
| CVE-2002-0656US | high7.5 | Exploit | ||
Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a lar… | ||||
| CVE-2002-0658US | medium6.2 | Exploit | ||
OSSP mm library (libmm) before 1.2.0 allows the local Apache user to gain privileges via temporary files, possibly via a symbolic link attack. | ||||
| CVE-2002-0659US | medium5.0 | Exploit | ||
The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings. | ||||
| CVE-2002-0653US | high7.8 | Exploit | ||
Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and earlier, allows local users to execute ar… | ||||
references
External citations — patches, advisories, analysis.
remediations (5)
- FixedRed Hat Stronghold 3
We have backported the security fixes for the versions of OpenSSL, mod_ssl and mm included in Stronghold 3. Stronghold 3.0 build code 3018 is now available which includes these fixes, and can be downloaded from http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3.0, see http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:164 - FixedRed Hat Stronghold 3
We have backported the security fixes for the versions of OpenSSL, mod_ssl and mm included in Stronghold 3. Stronghold 3.0 build code 3018 is now available which includes these fixes, and can be downloaded from http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3.0, see http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:164 - FixedRed Hat Stronghold 3
We have backported the security fixes for the versions of OpenSSL, mod_ssl and mm included in Stronghold 3. Stronghold 3.0 build code 3018 is now available which includes these fixes, and can be downloaded from http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3.0, see http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:164 - FixedRed Hat Stronghold 3
We have backported the security fixes for the versions of OpenSSL, mod_ssl and mm included in Stronghold 3. Stronghold 3.0 build code 3018 is now available which includes these fixes, and can be downloaded from http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3.0, see http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:164 - FixedRed Hat Stronghold 3
We have backported the security fixes for the versions of OpenSSL, mod_ssl and mm included in Stronghold 3. Stronghold 3.0 build code 3018 is now available which includes these fixes, and can be downloaded from http://stronghold.redhat.com/sh3/ For information on how to upgrade between releases of Stronghold 3.0, see http://stronghold.redhat.com/support/upgrade-sh3.xml
https://access.redhat.com/errata/RHSA-2002:164
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan