Vulnerabilities in OpenSSL
Three security issues have been identified in the Open Source implementation of the SSL/TLS protocol, OpenSSL. The vulnerabilities allow targeted attacks.
Developer Andy Polyakov discovered a vulnerability (CVE-2007-4995) in OpenSSL that attackers can exploit for denial of service attacks. The bug, of which details have not been disclosed, affects the DTLS implementation. A successful attack would allow a hacker to execute arbitrary code. The vulnerability only affects systems that use DTLS. All 0.9.8 versions up to but not including 0.9.8f are affected, as are 0.9.7 through 0.9.7m.
A second vulnerability has been identified and published under CVE-2007-5135. An off-by-one error in the "SSL_get_shared_ciphers()" function provokes an overflow with a currently unknown effect. The feature is typically used for logging and debugging purposes.
A third vulnerability, which was identified awhile back (CVE-2007-3108), affects the incorrect implementation of Montgomery multiplication in the "crypto/bn/bn_mont.c" function. The bug could give local users the ability to launch side channel attacks and thus capture RSA private keys.
Users are advised to update to the current 0.9.8f version to close the first vulnerability, and to rebuild any packages that use DTLS. If this is not available as an option, the OpenSSl developers suggest disabling DTLS. Damage caused by the second vulnerability can be prevented by not using the affected feature. Updated packages that close all three security holes are available for Red Hat.
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
TuxCare Announces Support for AlmaLinux 9.2
Thanks to TuxCare, AlmaLinux 9.2 (and soon version 9.6) now enjoys years of ongoing patching and compliance.
-
Go-Based Botnet Attacking IoT Devices
Using an SSH credential brute-force attack, the Go-based PumaBot is exploiting IoT devices everywhere.
-
Plasma 6.5 Promises Better Memory Optimization
With the stable Plasma 6.4 on the horizon, KDE has a few new tricks up its sleeve for Plasma 6.5.
-
KaOS 2025.05 Officially Qt5 Free
If you're a fan of independent Linux distributions, the team behind KaOS is proud to announce the latest iteration that includes kernel 6.14 and KDE's Plasma 6.3.5.
-
Linux Kernel 6.15 Now Available
The latest Linux kernel is now available with several new features/improvements and the usual bug fixes.
-
Microsoft Makes Surprising WSL Announcement
In a move that might surprise some users, Microsoft has made Windows Subsystem for Linux open source.
-
Red Hat Releases RHEL 10 Early
Red Hat quietly rolled out the official release of RHEL 10.0 a bit early.
-
openSUSE Joins End of 10
openSUSE has decided to not only join the End of 10 movement but it also will no longer support the Deepin Desktop Environment.
-
New Version of Flatpak Released
Flatpak 1.16.1 is now available as the latest, stable version with various improvements.
-
IBM Announces Powerhouse Linux Server
IBM has unleashed a seriously powerful Linux server with the LinuxONE Emperor 5.