ID

VAR-201410-1418

CVE

CVE-2014-3566

TITLE

Apple Security Advisory 2014-10-16-4

DESCRIPTION

The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. SSL protocol is the abbreviation of Secure Socket Layer protocol (Secure Socket Layer) developed by Netscape, which provides security and data integrity guarantee for Internet communication. There is a security vulnerability in the SSL protocol 3.0 version used in OpenSSL 1.0.1i and earlier versions. The vulnerability is caused by the program's use of non-deterministic CBC padding. Attackers can use padding-oracle attacks to exploit this vulnerability to implement man-in-the-middle attacks and obtain plaintext data. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-4 OS X Server v3.2.2 OS X Server v3.2.2 is now available and addresses the following: Server Available for: OS X Mavericks v10.9.5 or later Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL 3.0 when a cipher suite uses a block cipher in CBC mode. An attacker could force the use of SSL 3.0, even when the server would support a better TLS version, by blocking TLS 1.0 and higher connection attempts. This issue was addressed by disabling SSL 3.0 support in Web Server, Calendar & Contacts Server, and Remote Administration. CVE-ID CVE-2014-3566 : Bodo Moeller, Thai Duong, and Krzysztof Kotowicz of Google Security Team OS X Server v3.2.2 may be obtained from the Mac App Store. Product Impacted Version HP Integration Adaptor v 9.1X HP Operations Manager for Windows v8.10, v8.16, v9.0 HP Operations Manager for Unix/Linux v 9.1x, v9.20 HP Operations Manager i v9.1x, v9.2x HP Reporter v3.90, v4.0 HP Operation Agent Virtual Appliance v11.11, v11.12, v11.13, v11.14 HP Performance Manager v 9.0x, v9.20 HP Virtualization Performance Viewer v1.0, v1.1, v1.2, v2.0, v2.01 HP Operations Agent v11.0, v11.01, v11.02,v11.03 v11.04,v11.05,v11.10,v11.11, v11.12,v11.13,v11.20,v11.14 HP SiteScope v11.1x, v11.2x Business Service Manager (BSM) v8.x, v9.1x, v9.2x HP BSM Connector v9.20, v9.21, v9.22, v9.23 HP Service Health Reporter v9.20, v9.30, v9.31, v9.32, v9.40 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-3566 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has released the following software update to resolve the vulnerability in the below products: Product Affected versions Links to resolution HP Integration Adaptor v9.1X https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451927?lang=en&cc=cr&hpappid=OSP HP Operations Manager for Windows v8.10, v8.16, v9.0 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451928?lang=en&cc=cr&hpappid=OSP HP Operations Manager for Unix/Linux v9.1x, v9.20 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451925?lang=en&cc=cr&hpappid=OSP HP Operations Manager i v9.1x, v9.2x https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04510230 HP Reporter v3.90, v4.0 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451924 HP Operation Agent Virtual Appliance v11.11, v11.12, v11.13, v11.14 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451923?lang=en&cc=cr&hpappid=OSP HP Performance Manager 9.0x, v9.20 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451922 HP Virtualization Performance Viewer v1.0, v1.1, v1.2, v2.0, v2.01 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451921 HP Operations Agent v11.0, v11.01, v11.02, v11.03, v11.04, v11.05, v11.10, v11.11, v11.12, v11.13, v11.20, v11.14 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451914?lang=en&cc=cr&hpappid=OSP HP SiteScope v11.1x, v11.2x Previous HP Security bulletin: https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04497114 HP Business Service Manager (BSM) v8.x, v9.1x, v9.2x Previous HP Security Bulletin: https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04510230 HP BSM Connector v9.20, v9.21, v9.22, v9.23 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01451763?lang=en&cc=cr&hpappid=OSP HP Service Health Reporter v9.20, v9.30, v9.31, v9.32, v9.40 https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01401951?lang=en&cc=cr&hpappid=OSP Note on Installation order of patches: On a node, if multiple products such as HP Performance Manager, HP Reporter, HP Service Health Reporter, and Operations Agent are available, first install Operations Agent POODLE patch and then POODLE patches for all other products. If this order of patch installation is not followed then the Installation of Operations Agent POODLE patch will fail. The installation error messages on Windows, Linux, HP-UX and Solaris are as follows: .For Windows: "Installation of the component package HPOvXpl failed with error (33529200) (The upgrade cannot be installed by the Windows Installer service because the program to be upgraded may be missing, or the upgrade may update a different version of the program. Verify that the program to be upgraded exists on your computer and that you have the correct upgrade. )." For Linux, HP-UX and Solaris: "Hotfix (Hotfix ID) cannot be installed as same or higher version of the component HPOvSecCo is already installed" These installation errors can be ignored if HPOvSecCore version in 'ovdeploy - -inv -includeupdates' is greater than or equal to v11.14.043 for v11.1x versions and greater than or equal to v11.05.046 for v11.1x and v11.0x versions of HPOvSecCOre respectively. In a typical operating environment, these are of low security risk as the runtime is not used on untrusted applets. Relevant releases/architectures: RHOSE Node 2.1 - noarch 3. Description: OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. These vulnerabilities could be exploited remotely to create a Denial of Service (DoS), allow unauthorized access, or a man-in-the-middle (MitM) attack. ftp://ssl098zc:Secure12@ftp.usa.hp.com User name: ssl098zc Password: (NOTE: Case sensitive) Secure12 HP-UX Release HP-UX OpenSSL version B.11.11 (11i v1) A.00.09.08zc.001_HP-UX_B.11.11_32+64.depot B.11.23 (11i v2) A.00.09.08zc.002_HP-UX_B.11.23_IA-PA.depot B.11.31 (11i v3) A.00.09.08zc.003_HP-UX_B.11.31_IA-PA.depot MANUAL ACTIONS: Yes - Update Install OpenSSL A.00.09.08zc or subsequent PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. 5 client) - i386, x86_64 3. Open the /opt/sdn/virgo/configuration/tomcat-server.xml file for editing Change the following line from this: clientAuth="false" sslEnabledProtocols="TLSv1.0, TLSv1.1,TLSv1.2" to this: clientAuth="false" sslEnabledProtocols=" TLSv1.1,TLSv1.2" Restart the controller. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04496538 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04496538 Version: 1 HPSBGN03164 rev.1 - HP IceWall SSO Dfw, SSO Certd and MCRP running OpenSSL, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2014-11-10 Last Updated: 2014-11-10 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP IceWall SSO Dfw , SSO Certd, and MCRP running OpenSSL. This is the SSLv3 vulnerability known as "Padding Oracle on Downgraded Legacy Encryption" or "Poodle", which could be exploited remotely resulting in disclosure of information.. References: CVE-2014-3566 (SSRT101789) SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. - HP IceWall MCRP v2.1, v3.0 - HP IceWall SSO Dfw v8.0, v8.0 R1, v8.0 R2, v8.0 R3, and v10.0 - HP IceWall SSO Certd v8.0R3 with DB plugin patch 2 and v10.0 BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-3566 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP recommends the following software updates and workaround instructions to resolve this vulnerability for HP IceWall SSO Dfw, SSO Certd, and MCRP. The software updates are available at: http://www.hp.com/jp/icewall_patchaccess Notes: - There are no updates or mitigations for MCRP 2.1 and Dfw 8.0/8.0R1/8.0R2/8.0R3. - HP recommends updating these older versions to the latest versions and patches and then following the WORKAROUND INSTRUCTIONS below. - The WORKAROUND INSTRUCTIONS should be followed after applying the following updates. Software Update Versions HP IceWall MCRP 3.0 Patch release 1 HP IceWall SSO Dfw 10.0 Patch release 7 Note: Both software update versions provide the use of TLSv1 which is not vulnerable and available for each supported platform. WORKAROUND INSTRUCTIONS HP recommends the following information to protect against potential risk for the following HP IceWall products. HP IceWall SSO Dfw and MCRP - If possible, do not use the SHOST setting which allows IceWall SSO Dfw or MCRP to use SSL/TLS protocol to back-end web servers. - The following steps should be applied if SSL/TLS protocol to back-end web servers must be used: o For MCRP: apply MCRP patch release 1 o For Dfw: apply Dfw patch release 7 or later o Set SSL_PROTOCOL parameter to TLSv1 HP IceWall SSO Certd - For Certd version 10.0 and 8.0R3: apply DB plugin patch release 2 - If possible, do not use the LDAPSSL setting which allows IceWall SSO Certd to connect to the LDAP server using SSL/TLS protocol. - If SSL/TLS protocol must be used to LDAP server, configure the LDAP server to use only TLSv1 as a mitigation for the vulnerability. For example, on an OpenLDAP server (slapd), Set the TLSProtocolMin parameter. Note: The HP IceWall product is only available in Japan. HISTORY Version:1 (rev.1) - 10 November 2014 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. HP SiteScope 11.1x HP SiteScope 11.2x Important note: HP SiteScope is impacted if and only if it is configured to work over secure channel (HTTPS). -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.6.0-openjdk security update Advisory ID: RHSA-2015:0085-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2015-0085.html Issue date: 2015-01-26 CVE Names: CVE-2014-3566 CVE-2014-6585 CVE-2014-6587 CVE-2014-6591 CVE-2014-6593 CVE-2014-6601 CVE-2015-0383 CVE-2015-0395 CVE-2015-0407 CVE-2015-0408 CVE-2015-0410 CVE-2015-0412 ===================================================================== 1. Summary: Updated java-1.6.0-openjdk packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, x86_64 Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 3. Description: The java-1.6.0-openjdk packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Java Software Development Kit. A flaw was found in the way the Hotspot component in OpenJDK verified bytecode from the class files. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions. (CVE-2014-6601) Multiple improper permission check issues were discovered in the JAX-WS, and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. (CVE-2015-0412, CVE-2015-0408) A flaw was found in the way the Hotspot garbage collector handled phantom references. An untrusted Java application or applet could use this flaw to corrupt the Java Virtual Machine memory and, possibly, execute arbitrary code, bypassing Java sandbox restrictions. (CVE-2015-0395) A flaw was found in the way the DER (Distinguished Encoding Rules) decoder in the Security component in OpenJDK handled negative length values. A specially crafted, DER-encoded input could cause a Java application to enter an infinite loop when decoded. (CVE-2015-0410) A flaw was found in the way the SSL 3.0 protocol handled padding bytes when decrypting messages that were encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw could possibly allow a man-in-the-middle (MITM) attacker to decrypt portions of the cipher text using a padding oracle attack. (CVE-2014-3566) Note: This update disables SSL 3.0 by default to address this issue. The jdk.tls.disabledAlgorithms security property can be used to re-enable SSL 3.0 support if needed. For additional information, refer to the Red Hat Bugzilla bug linked to in the References section. It was discovered that the SSL/TLS implementation in the JSSE component in OpenJDK failed to properly check whether the ChangeCipherSpec was received during the SSL/TLS connection handshake. An MITM attacker could possibly use this flaw to force a connection to be established without encryption being enabled. (CVE-2014-6593) An information leak flaw was found in the Swing component in OpenJDK. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions. (CVE-2015-0407) A NULL pointer dereference flaw was found in the MulticastSocket implementation in the Libraries component of OpenJDK. An untrusted Java application or applet could possibly use this flaw to bypass certain Java sandbox restrictions. (CVE-2014-6587) Multiple boundary check flaws were found in the font parsing code in the 2D component in OpenJDK. A specially crafted font file could allow an untrusted Java application or applet to disclose portions of the Java Virtual Machine memory. (CVE-2014-6585, CVE-2014-6591) Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack. (CVE-2015-0383) The CVE-2015-0383 issue was discovered by Red Hat. All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1123870 - CVE-2015-0383 OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807) 1152789 - CVE-2014-3566 SSL/TLS: Padding Oracle On Downgraded Legacy Encryption attack 1183020 - CVE-2014-6601 OpenJDK: class verifier insufficient invokespecial calls verification (Hotspot, 8058982) 1183021 - CVE-2015-0412 OpenJDK: insufficient code privileges checks (JAX-WS, 8054367) 1183023 - CVE-2015-0408 OpenJDK: incorrect context class loader use in RMI transport (RMI, 8055309) 1183031 - CVE-2015-0395 OpenJDK: phantom references handling issue in garbage collector (Hotspot, 8047125) 1183043 - CVE-2015-0407 OpenJDK: directory information leak via file chooser (Swing, 8055304) 1183044 - CVE-2015-0410 OpenJDK: DER decoder infinite loop (Security, 8059485) 1183049 - CVE-2014-6593 OpenJDK: incorrect tracking of ChangeCipherSpec during SSL/TLS handshake (JSSE, 8057555) 1183645 - CVE-2014-6585 ICU: font parsing OOB read (OpenJDK 2D, 8055489) 1183646 - CVE-2014-6591 ICU: font parsing OOB read (OpenJDK 2D, 8056276) 1183715 - CVE-2014-6587 OpenJDK: MulticastSocket NULL pointer dereference (Libraries, 8056264) 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el5_11.src.rpm i386: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el5_11.i386.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el5_11.src.rpm i386: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el5_11.i386.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el5_11.i386.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el5_11.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 6): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.src.rpm i386: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): i386: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.src.rpm i386: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): i386: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.src.rpm i386: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6.i686.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): i386: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6.i686.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6.i686.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el6_6.x86_64.rpm Red Hat Enterprise Linux Client (v. 7): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm Red Hat Enterprise Linux Server (v. 7): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.src.rpm ppc64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.ppc64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.ppc64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el7_0.ppc64.rpm s390x: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.s390x.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.s390x.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el7_0.s390x.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.ppc64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el7_0.ppc64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el7_0.ppc64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el7_0.ppc64.rpm s390x: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.s390x.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el7_0.s390x.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el7_0.s390x.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el7_0.s390x.rpm x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.src.rpm x86_64: java-1.6.0-openjdk-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-devel-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: java-1.6.0-openjdk-debuginfo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-demo-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-javadoc-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm java-1.6.0-openjdk-src-1.6.0.34-1.13.6.1.el7_0.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2014-3566 https://access.redhat.com/security/cve/CVE-2014-6585 https://access.redhat.com/security/cve/CVE-2014-6587 https://access.redhat.com/security/cve/CVE-2014-6591 https://access.redhat.com/security/cve/CVE-2014-6593 https://access.redhat.com/security/cve/CVE-2014-6601 https://access.redhat.com/security/cve/CVE-2015-0383 https://access.redhat.com/security/cve/CVE-2015-0395 https://access.redhat.com/security/cve/CVE-2015-0407 https://access.redhat.com/security/cve/CVE-2015-0408 https://access.redhat.com/security/cve/CVE-2015-0410 https://access.redhat.com/security/cve/CVE-2015-0412 https://access.redhat.com/security/updates/classification/#important https://bugzilla.redhat.com/show_bug.cgi?id=1152789#c82 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2015 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFUxoikXlSAg2UNWIIRAtveAJkBIGMryPUZPWXcj32TyREuic5EHACdHl44 DgMBIZO4w7NRL+WYlkXeJdQ= =86e1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . SSLv3 is enabled by default in the current HP iCAS client software. - iCAS version 14.11-38437 The HP iCAS client should be used to connect to HP at https://midway.corp.hp.com/icas/current/iCasStart.html which will force the upgrade to iCAS version 14.11-38437. Note: The new version of HP iCAS has updated OpenSSL libraries from OpenSSL version 1.0.0g to 1.0.1j

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

EXPLOIT AVAILABILITY

EXTERNAL IDS

REFERENCES