-----BEGIN PGP SIGNED MESSAGE-----


		 NetBSD Security Advisory 2002-009
		 =================================
		 (updated 2002/9/16)

Topic:		Multiple vulnerabilities in OpenSSL code

Version:	NetBSD-current:	 source prior to August 10, 2002
		NetBSD-1.6 beta: affected
		NetBSD-1.5.3:	 affected
		NetBSD-1.5.2:	 affected
		NetBSD-1.5.1:	 affected
		NetBSD-1.5:	 affected
		NetBSD-1.4.*:	 not applicable
		pkgsrc:		 prior to openssl-0.9.6f

Severity:	Potential for remote root exploit

Fixed:		NetBSD-current:		August 10, 2002
		NetBSD-1.6 branch:	August 11, 2002 (1.6 includes the fix)
		NetBSD-1.5 branch:	August 31, 2002
		pkgsrc:			openssl-0.9.6f (or later)

	NOTE: previous advisory had fixed dates prior to August 10.
	There were errors found in the vendor-supplied fix, therefore
	the fixed dates were modified.  Sorry for the confusion and
	thanks for the patience.

	NOTE: previous revision of advisory suggested that 1.5 branch
	was fixed on August 1, however the fix was found to be
	insufficient.  Therefore, users of 1.5 should apply the fix
	presented in this revised advisory.  Sorry for the confusion
	and thanks for the patience.


Abstract
========

There are multiple vulnerabilities found in openssl 0.9.6e and prior
releases.  There are four remotely-exploitable buffer overruns in SSL2/3
code.  The ASN1 parser can be confused by invalid encodings (SSL/TLS
code affected).

None of these services are enabled by default in NetBSD, however, by
enabling services built with these libraries, a system would become
vulnerable.

- From the OpenSSL advisory:

  "Everyone using OpenSSL 0.9.6d or earlier, or 0.9.7-beta2 or earlier or
  current development snapshots of 0.9.7 to provide SSL or TLS is
  vulnerable, whether client or server. 0.9.6d servers on 32-bit systems
  with SSL 2.0 disabled are not vulnerable."

After the above advisory was published,
  - 0.9.6e was found to be vulnerable, and 0.9.6f was released.
  - 0.9.6f had some build framework errors, and 0.9.6g was released.

The NetBSD fix includes OpenSSL 0.9.6g.


Technical Details
=================

http://www.openssl.org/news/secadv_20020730.txt
http://CERT.Uni-Stuttgart.DE/advisories/c-integer-overflow.php


Solutions and Workarounds
=========================

The recent NetBSD 1.6 release is not vulnerable to this issue. A full
upgrade to NetBSD 1.6 is the recommended resolution for all users able
to do so. Many security-related improvements have been made, and
indeed this release has been delayed several times in order to include
fixes for a number of recent issues.

The following instructions describe how to upgrade your libcrypto/libssl
binaries by updating your source tree and rebuilding and
installing a new version of libcrypto/libssl.

Be sure to restart running instances of programs that use crypto libraries
(like sshd) after upgrading shared libraries.

If you have any statically-linked binaries that linked against a
vulnerable libcrypto and/or libssl, you need to recompile them.


* NetBSD-current:

	Systems running NetBSD-current dated from before 2002-08-10
	should be upgraded to NetBSD-current dated 2002-08-10 or later.

	The following directories need to be updated from the
	netbsd-current CVS branch (aka HEAD):
		crypto/Makefile.openssl
		crypto/dist/openssl
		lib/libcrypto
		lib/libssl

	To update from CVS, re-build, and re-install libcrypto and libssl:
		# cd src
		# cvs update -d -P crypto/Makefile.openssl crypto/dist/openssl \
			lib/libcrypto lib/libssl

		# make includes
		# cd lib/libcrypto
		# make cleandir dependall
		# make install
		# cd ../../lib/libssl
		# make cleandir dependall
		# make install


* NetBSD 1.6 beta:

	Systems running NetBSD 1.6 BETAs and Release Candidates should
	be upgraded to the NetBSD 1.6 release.

	If a source-based point upgrade is required, sources from the
	NetBSD 1.6 branch dated 2002-08-11 or later should be used.

	The following directories need to be updated from the
	netbsd-1-6 CVS branch:
		crypto/Makefile.openssl
		crypto/dist/openssl
		lib/libcrypto
		lib/libssl

	To update from CVS, re-build, and re-install libcrypto and libssl:
		# cd src
		# cvs update -d -P -r netbsd-1-6 crypto/Makefile.openssl \
			crypto/dist/openssl lib/libcrypto lib/libssl

		# make includes
		# cd lib/libcrypto
		# make cleandir dependall
		# make install
		# cd ../../lib/libssl
		# make cleandir dependall
		# make install


* NetBSD 1.5, 1.5.1, 1.5.2, 1.5.3:

	Systems running NetBSD-1.5.x dated from before 2002-08-31
	should be upgraded to NetBSD-1.5 branch dated 2002-08-31 or later.

	The following directories need to be updated from the
	netbsd-1-5 CVS branch.  Due to the shlib major bump in libcrypto/libssl
	large number of shared libraries has to be rebuilt:
		crypto/Makefile.openssl
		crypto/dist/openssl
		lib/libasn1
		lib/libcom_err
		lib/libcrypto
		lib/libgssapi
		lib/libhdb
		lib/libkadm
		lib/libkadm5clnt
		lib/libkadm5srv
		lib/libkafs
		lib/libkdb
		lib/libkrb
		lib/libkrb5
		lib/libkstream
		lib/libroken
		lib/libsl
		lib/libss
		lib/libtelnet
		usr.bin/openssl

	To update from CVS, re-build, and re-install libcrypto and libssl:
		# cd src
		# cvs update -d -P -r netbsd-1-5 <directories listed above>

		# make includes
		# cd lib
		# make cleandir dependall
		# make install
		# cd usr.bin/openssl
		# make cleandir dependall
		# make install


* NetBSD 1.4, 1.4.1, 1.4.2, 1.4.3:

	OpenSSL was not included in the base system in NetBSD-1.4.*
	Follow the directions for pkgsrc if you have installed it from
	pkgsrc.


* pkgsrc:

	openssl (pkgsrc/security/openssl) prior to 0.9.6f are
	vulnerable.  Upgrade to openssl-0.9.6f or later; pkgsrc
	currently contains 0.9.6g at time of this writing.

	Packages which require openssl can be found by running 'pkg_info
	openssl'. Depending on the method you choose to update pkgsrc
	packages, a rebuild of the packages on that list may be
	performed for you by the package system. If you update using the
	experimental 'make replace' target, you will need to manually
	update any packages which build static binaries with libssl.a
	and libcrypto.a

        If you have statically linked binaries in pkgsrc, they have to be
        rebuilt.  Statically linked binaries can be identified by the
        following command (note: be sure to include the directory you install
        pkgsrc binaries to, if you've changed LOCALBASE from the default of
        /usr/pkg)

                file /usr/pkg/{bin,sbin,libexec} | grep static


Thanks To
=========

A.L. Digital Ltd and John McDonald of Neohapsis.
Adi Stav and James Yonan.
CERT and the OpenSSL team.

Jun-ichiro itojun Hagino for maintenance of OpenSSL in the NetBSD
source tree, and preparing the initial advisory text.

The NetBSD Release Engineering teams, for great patience and
assistance in dealing with repeated security issues discovered
recently.


Revision History
================

	2002-08-01	Initial release based on 0.9.6e
	2002-08-11	based on 0.9.6f
	2002-08-31	1.5 pullup done, 0.9.6g
	2002-09-16	Re-release with updated information


More Information
================

An up-to-date PGP signed copy of this release will be maintained at
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-009.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 2002, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA2002-009.txt,v 1.35 2002/09/16 05:17:55 dan Exp $


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBPYVqAD5Ru2/4N2IFAQHqtwQAluG+9I3pVeALK+p+X3ZNG99M2zx6y/Ea
IX7kS8M22PoZD6kJniBRWqcDfaYqj5FKHT1TlCAiehNUpQfdADQD/0i/nqX01puI
aCCLXIetnRwSmQdW3IcbWqs5NQvHuWOB+ng1t5DBF1rF9GPTRMmrv5Sjr27hl07X
+ta7U3VZCms=
=SEqH
-----END PGP SIGNATURE-----