blob: c935e44eeb469a43ab1853a0ebd03e3e4c4d25f9 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200803-30">
<title>ssl-cert eclass: Certificate disclosure</title>
<synopsis>
An error in the usage of the ssl-cert eclass within multiple ebuilds might
allow for disclosure of generated SSL private keys.
</synopsis>
<product type="ebuild">ssl-cert.eclass</product>
<announced>2008-03-20</announced>
<revised count="01">2008-03-20</revised>
<bug>174759</bug>
<access>remote</access>
<affected>
<package name="app-admin/conserver" auto="yes" arch="*">
<unaffected range="ge">8.1.16</unaffected>
<vulnerable range="lt">8.1.16</vulnerable>
</package>
<package name="mail-mta/postfix" auto="yes" arch="*">
<unaffected range="ge">2.4.6-r2</unaffected>
<unaffected range="rge">2.3.8-r1</unaffected>
<unaffected range="rge">2.2.11-r1</unaffected>
<vulnerable range="lt">2.4.6-r2</vulnerable>
</package>
<package name="net-ftp/netkit-ftpd" auto="yes" arch="*">
<unaffected range="ge">0.17-r7</unaffected>
<vulnerable range="lt">0.17-r7</vulnerable>
</package>
<package name="net-im/ejabberd" auto="yes" arch="*">
<unaffected range="ge">1.1.3</unaffected>
<vulnerable range="lt">1.1.3</vulnerable>
</package>
<package name="net-irc/unrealircd" auto="yes" arch="*">
<unaffected range="ge">3.2.7-r2</unaffected>
<vulnerable range="lt">3.2.7-r2</vulnerable>
</package>
<package name="net-mail/cyrus-imapd" auto="yes" arch="*">
<unaffected range="ge">2.3.9-r1</unaffected>
<vulnerable range="lt">2.3.9-r1</vulnerable>
</package>
<package name="net-mail/dovecot" auto="yes" arch="*">
<unaffected range="ge">1.0.10</unaffected>
<vulnerable range="lt">1.0.10</vulnerable>
</package>
<package name="net-misc/stunnel" auto="yes" arch="*">
<unaffected range="ge">4.21-r1</unaffected>
<unaffected range="lt">4.0</unaffected>
<vulnerable range="lt">4.21-r1</vulnerable>
</package>
<package name="net-nntp/inn" auto="yes" arch="*">
<unaffected range="ge">2.4.3-r1</unaffected>
<vulnerable range="lt">2.4.3-r1</vulnerable>
</package>
</affected>
<background>
<p>
The ssl-cert eclass is a code module used by Gentoo ebuilds to generate
SSL certificates.
</p>
</background>
<description>
<p>
Robin Johnson reported that the docert() function provided by
ssl-cert.eclass can be called by source building stages of an ebuild,
such as src_compile() or src_install(), which will result in the
generated SSL keys being included inside binary packages (binpkgs).
</p>
</description>
<impact type="normal">
<p>
A local attacker could recover the SSL keys from publicly readable
binary packages when "<i>emerge</i>" is called with the "<i>--buildpkg
(-b)</i>" or "<i>--buildpkgonly (-B)</i>" option. Remote attackers can
recover these keys if the packages are served to a network. Binary
packages built using "<i>quickpkg</i>" are not affected.
</p>
</impact>
<workaround>
<p>
Do not use pre-generated SSL keys, but use keys that were generated
using a different Certificate Authority.
</p>
</workaround>
<resolution>
<p>
Upgrading to newer versions of the above packages will neither remove
possibly compromised SSL certificates, nor old binary packages. Please
remove the certificates installed by Portage, and then emerge an
upgrade to the package.
</p>
<p>
All Conserver users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/conserver-8.1.16"</code>
<p>
All Postfix 2.4 users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.4.6-r2"</code>
<p>
All Postfix 2.3 users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.3.8-r1"</code>
<p>
All Postfix 2.2 users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-mta/postfix-2.2.11-r1"</code>
<p>
All Netkit FTP Server users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-ftp/netkit-ftpd-0.17-r7"</code>
<p>
All ejabberd users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-im/ejabberd-1.1.3"</code>
<p>
All UnrealIRCd users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-irc/unrealircd-3.2.7-r2"</code>
<p>
All Cyrus IMAP Server users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-mail/cyrus-imapd-2.3.9-r1"</code>
<p>
All Dovecot users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-mail/dovecot-1.0.10"</code>
<p>
All stunnel 4 users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/stunnel-4.21"</code>
<p>
All InterNetNews users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-nntp/inn-2.4.3-r1"</code>
</resolution>
<references>
<uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1383">CVE-2008-1383</uri>
</references>
<metadata tag="submitter" timestamp="2008-03-14T23:17:10Z">
rbu
</metadata>
<metadata tag="bugReady" timestamp="2008-03-15T00:11:06Z">
rbu
</metadata>
</glsa>
|
