topic Re: T1471AA release A.03.71 (OpenSSH) is concerned by Security Alert TA04-078A of OpenSSL in Operating System - HP-UX

T1471AA release A.03.71 (OpenSSH) is concerned by Security Alert TA04-078A of OpenSSL

Jdamian — Wed, 24 Mar 2004 07:12:52 GMT

Hi
I received a notification to update OpenSSL due to some bugs.

http://www.us-cert.gov/cas/techalerts/TA04-078A.html

I read README.hp file installed by OpenSSH A.03.71 (T1471AA). In this file you find:

HP built HP-UX Secure Shell A.03.71 with the following libraries:

* zlib v1.1.4

* OpenSSL v0.9.7c

* TCP Wrappers v7.6

In other words, release A.03.71 is built on OpenSSL v0.9.7c that contains the bugs listed in link above.

When a new release will be available to solve this bugs ?

Re: T1471AA release A.03.71 (OpenSSH) is concerned by Security Alert TA04-078A of OpenSSL

Alzhy — Wed, 24 Mar 2004 08:35:45 GMT

Oh joy, I was just about to deploy this HP release. I suppose the A.03.61.x release also has this problem?

Re: T1471AA release A.03.71 (OpenSSH) is concerned by Security Alert TA04-078A of OpenSSL

Cheryl Griffin — Wed, 24 Mar 2004 08:53:02 GMT

It has been reported to the security lab and is under investigation. There is no further information or release date available. HP will issue a security bulletin when ready to make a statement.

Security Bulletins are available for http://www1.itrc.hp.com/service/cki/secBullArchive.do HP provides automatic notification for new bulletins by subscribing to the SB Digest.

Re: T1471AA release A.03.71 (OpenSSH) is concerned by Security Alert TA04-078A of OpenSSL

Cheryl Griffin — Wed, 24 Mar 2004 08:55:22 GMT

In addition, you can address your concerns directly to the security team by email: security-alert@hp.com

No detailed vulnerability information should be sent to this email address without encryption.

Re: T1471AA release A.03.71 (OpenSSH) is concerned by Security Alert TA04-078A of OpenSSL

Jdamian — Tue, 30 Mar 2004 03:05:41 GMT

I opened a call in my Support Centre about this issue.

They confirmed that OpenSSH is NOT CONCERNED by the bugs in OpenSSL due to the functions quoted in the security alert are not used by OpenSSH.