Vulnerabilities in OpenSSL
Three security issues have been identified in the Open Source implementation of the SSL/TLS protocol, OpenSSL. The vulnerabilities allow targeted attacks.
Developer Andy Polyakov discovered a vulnerability (CVE-2007-4995) in OpenSSL that attackers can exploit for denial of service attacks. The bug, of which details have not been disclosed, affects the DTLS implementation. A successful attack would allow a hacker to execute arbitrary code. The vulnerability only affects systems that use DTLS. All 0.9.8 versions up to but not including 0.9.8f are affected, as are 0.9.7 through 0.9.7m.
A second vulnerability has been identified and published under CVE-2007-5135. An off-by-one error in the "SSL_get_shared_ciphers()" function provokes an overflow with a currently unknown effect. The feature is typically used for logging and debugging purposes.
A third vulnerability, which was identified awhile back (CVE-2007-3108), affects the incorrect implementation of Montgomery multiplication in the "crypto/bn/bn_mont.c" function. The bug could give local users the ability to launch side channel attacks and thus capture RSA private keys.
Users are advised to update to the current 0.9.8f version to close the first vulnerability, and to rebuild any packages that use DTLS. If this is not available as an option, the OpenSSl developers suggest disabling DTLS. Damage caused by the second vulnerability can be prevented by not using the affected feature. Updated packages that close all three security holes are available for Red Hat.
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
Linux Mint 27 Set for a Christmas Release
The developers behind Linux Mint have announced a Christmas release, and it looks like Santa's sack will be brimming with features.
-
Is Linus Torvalds Vibe Coding?
The creator of Linux has added AI into his process for Linux kernel development, and it's more than just for debugging.
-
openKylin 3.0 Released with Expanded AI Integration
The latest release features a pre-installed AI agent to help perform tasks.
-
DigitalOcean Ends Open Source Credits Program
In a change that has surprised many open source developers, DigitalOcean has decided to sunset its Open Source Credits Program.
-
Office 365 Available for Testing on Linux via Bottles
Linux users can now test the official Office 365, thanks to Mirko Brombin's work on Bottles.
-
Dutch Government Turns to Open Source for Digital Sovereignty
Following in the footsteps of other European countries, the Netherlands is looking to increase its sovereign digital infrastructure with open source software.
-
Linux May Soon Work on Snapdragon X2-Based PCs
If you're thinking about buying a Snapdragon X2-based desktop or laptop, Linux may soon be an option.
-
KDE for People Initiative Calls for AI Ban in Plasma
A new community of KDE wants the project to adopt a strict no-AI policy for KDE Plasma.
-
KDE Sets Ambitious Goals for 2026 and Beyond
KDE Connect reveals the goals for the Linux desktop darling, with one of those goals long overdue.
-
It’s Time to Test Fedora 45 Beta
Fedora 45 beta has been released with updated Gnome, KDE Plasma, and kernel.