BugTraq
[ MDVSA-2013:003 ] rootcerts Jan 09 2013 05:58PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:003
http://www.mandriva.com/security/
_______________________________________________________________________

Package : rootcerts
Date : January 9, 2013
Affected: 2011.
_______________________________________________________________________

Problem Description:

Google reported to Mozilla that TURKTRUST, a certificate authority in
Mozillas root program, had mis-issued two intermediate certificates
to customers. The issue was not specific to Firefox but there was
evidence that one of the certificates was used for man-in-the-middle
(MITM) traffic management of domain names that the customer did not
legitimately own or control. This issue was resolved by revoking the
trust for these specific mis-issued certificates (CVE-2013-0743).

The rootcerts package has been upgraded to address this flaw and the
Mozilla NSS package has been rebuilt to pickup the changes.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0743
http://www.mozilla.org/security/announce/2013/mfsa2013-20.html
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2011:
196c985cb9a0c43026b517740bc84964 2011/i586/libnss3-3.14-0.2-mdv2011.0.i586.rpm
9e8211d7552f2f4c29e5100c2e22666d 2011/i586/libnss-devel-3.14-0.2-mdv2011.0.i586.rpm
73cac4a13ff3263762bd6e6958fd9ee5 2011/i586/libnss-static-devel-3.14-0.2-mdv2011.0.i586.rpm
22b7d7c8c8cb651dc8f029ea4a21df62 2011/i586/nss-3.14-0.2-mdv2011.0.i586.rpm
d4104fdc7fd808e2065cf11c9579881e 2011/i586/rootcerts-20121229.00-1-mdv2011.0.i586.rpm
8892d8d81576147685b6c6c2f27a3cc1 2011/i586/rootcerts-java-20121229.00-1-mdv2011.0.i586.rpm
2a1932633742f095598acbc71a65e07e 2011/SRPMS/nss-3.14-0.2.src.rpm
988252152ffcacd263670b84a70a4eb3 2011/SRPMS/rootcerts-20121229.00-1.src.rpm

Mandriva Linux 2011/X86_64:
cceba1cdc46199e9acf7702784637321 2011/x86_64/lib64nss3-3.14-0.2-mdv2011.0.x86_64.rpm
6cea0e30ea682bf7a067486b17205107 2011/x86_64/lib64nss-devel-3.14-0.2-mdv2011.0.x86_64.rpm
ba17542fa03c2e19ad05f49fd7be52bc 2011/x86_64/lib64nss-static-devel-3.14-0.2-mdv2011.0.x86_64.rpm
d89adc7b2d715f9979e30b40881c7f6a 2011/x86_64/nss-3.14-0.2-mdv2011.0.x86_64.rpm
6f42e1222e7670a942e887f6e1dd5a00 2011/x86_64/rootcerts-20121229.00-1-mdv2011.0.x86_64.rpm
da48a7a352314122da074e9831d6a8ac 2011/x86_64/rootcerts-java-20121229.00-1-mdv2011.0.x86_64.rpm
2a1932633742f095598acbc71a65e07e 2011/SRPMS/nss-3.14-0.2.src.rpm
988252152ffcacd263670b84a70a4eb3 2011/SRPMS/rootcerts-20121229.00-1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFQ7YQ2mqjQ0CJFipgRAhEXAKCO40WVKjgaPnLl2Miwavd8dbpWxwCgv5jg
bOqBKm41lnWZcvt9di0Tp+8=
=nfc8
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus