OSVDB ID: 52865

Title: OpenSSL CMS_verify() Function Malformed Signed Attribute Content Digest Validity Spoofing

Info

Disclosure

Mar 25, 2009

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Classification

Solution: Upgrade
Disclosure: Vendor Verified

Solution

Upgrade to version 0.9.8k or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

Security Tracker: 1021907
CVE ID: 2009-0591 (see also: NVD)
Bugtraq ID: 34256
Secunia Advisory ID: 34411 34460 34606 34666 35065 35070 35075 35086 35380 35729 36701 40235 42724 42733
ISS X-Force ID: 49432
Related OSVDB ID: 52864 52866
Keyword: c01762423,HPSBUX02435,SSRT090059 c02227287, HPSBOV02540, SSRT090249
Other Advisory URL: http://aix.software.ibm.com/aix/efixes/security/ssl_advisory.asc
http://voodoo-circle.sourceforge.net/sa/sa-20090326-01.html
http://www.openssl.org/news/secadv_20090325.txt
http://www.vupen.com/english/advisories/2009/0850
http://xorl.wordpress.com/2009/04/02/cve-2009-0591-openssl-signed-attributes-security-bypass/
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2009-06/0112.html
Vendor Specific Advisory URL: http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-008.txt.asc
http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02227287
http://support.apple.com/kb/HT3864
http://www.php.net/archive/2009.php#id2009-04-08-1
Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00000.html
http://sourceforge.net/project/showfiles.php?group_id=69227&package_id=127780&release_id=682473
http://sourceforge.net/project/showfiles.php?group_id=69227&package_id=68081&release_id=682472
http://sourceforge.net/project/shownotes.php?release_id=671059&group_id=116847
http://sourceforge.net/project/shownotes.php?release_id=682472&group_id=69227
http://sourceforge.net/project/shownotes.php?release_id=682473&group_id=69227
http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.439047
https://www13.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c01762423
News Article: http://www.theregister.co.uk/2009/09/11/apple_security_updates/
Vendor Specific Solution URL: https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/52865