RHSA-2008:0629: Moderate: Red Hat Network Satellite Server Solaris client security update

This release corrects several security vulnerabilities in componentsshipped as part of the Red Hat Network Satellite Server Solaris client. Ina typical operating environment, these components are not used by theSatellite Server in a vulnerable manner. These security updates will reducerisk should these components be used by other applications.Several flaws in Zlib were discovered. An attacker could create acarefully-crafted compressed stream that would cause an application tocrash if the stream was opened by a user. (CVE-2005-2096, CVE-2005-1849)A buffer overflow was discovered in the OpenSSL SSLgetsharedciphers()utility function. An attacker could send a list of ciphers to anapplication that used this function and overrun a buffer (CVE-2006-3738).A flaw in the SSLv2 client code was discovered. If a client applicationused OpenSSL to create an SSLv2 connection to a malicious server, thatserver could cause the client to crash. (CVE-2006-4343)An attack on OpenSSL PKCS #1 v1.5 signatures was discovered. Where an RSAkey with exponent 3 was used an attacker could, potentially, forge a PKCS#1 v1.5 signature that would be incorrectly verified by implementationsthat do not check for excess data in the RSA exponentiation result of thesignature. This issue affected applications that use OpenSSL to verifyX.509 certificates as well as other uses of PKCS #1 v1.5. (CVE-2006-4339)OpenSSL contained a software work-around for a bug in SSL handling inMicrosoft Internet Explorer version 3.0.2. It is enabled in most serversthat use OpenSSL to provide support for SSL and TLS. This work-around wasvulnerable to a man-in-the-middle attack which allowed a remote user toforce an SSL connection to use SSL 2.0, rather than a stronger protocol,such as SSL 3.0 or TLS 1.0. (CVE-2005-2969)During OpenSSL parsing of certain invalid ASN.1 structures, an errorcondition was mishandled. This could result in an infinite loop whichconsumed system memory (CVE-2006-2937).Certain public key types could take disproportionate amounts of time toprocess in OpenSSL, leading to a denial of service. (CVE-2006-2940)A flaw was discovered in the Python repr() function's handling ofUTF-32/UCS-4 strings. If an application used the repr() function onuntrusted data, this could lead to a denial of service or, possibly, allowthe execution of arbitrary code with the privileges of the applicationusing the flawed function. (CVE-2006-4980)A flaw was discovered in the strxfrm() function of Python's locale module.Strings generated by this function were not properly NULL-terminated. Thiscould, potentially, cause disclosure of data stored in the memory of anapplication using this function. (CVE-2007-2052)Multiple integer overflow flaws were discovered in Python's imageop module.If an application used the imageop module to process untrusted images, itcould cause the application to crash, enter an infinite loop, or, possibly,execute arbitrary code with the privileges of the Python interpreter.(CVE-2007-4965)A stack-based buffer overflow was discovered in the Python interpreter,which could allow a local user to gain privileges by running a script witha long name from the current working directory. (CVE-2006-1542)Users of Red Hat Network Satellite Server should upgrade to these updatedpackages, which contain backported patches to correct these issues.