Mandriva Linux Security Advisory : openssl (MDVSA-2014:203)
High Nessus Plugin ID 78665
Synopsis
The remote Mandriva Linux host is missing one or more security updates.
Description
Multiple vulnerabilities has been discovered and corrected in openssl :
OpenSSL has added support for TLS_FALLBACK_SCSV to allow applications to block the ability for a MITM attacker to force a protocol downgrade. Some client applications (such as browsers) will reconnect using a downgraded protocol to work around interoperability bugs in older servers. This could be exploited by an active man-in-the-middle to downgrade connections to SSL 3.0 even if both sides of the connection support higher protocols. SSL 3.0 contains a number of weaknesses including POODLE (CVE-2014-3566).
When an OpenSSL SSL/TLS/DTLS server receives a session ticket the integrity of that ticket is first verified. In the event of a session ticket integrity check failing, OpenSSL will fail to free memory causing a memory leak. By sending a large number of invalid session tickets an attacker could exploit this issue in a Denial Of Service attack (CVE-2014-3567).
The updated packages have been upgraded to the 1.0.0o version where these security flaws has been fixed.
Solution
Update the affected packages.