|
Multiple Vendor Invalid X.509 Certificate Chain Vulnerability
Solution: For sensitive applications, the certificate chain may be manually inspected whenever a SSL connection is initiated. The presence of an intermediate certificate authority may indicate that an attack is being attempted. An updated version of the TinySSL library is available. It may be retrieved through anonymous CVS as part of the XWT project: http://www.xwt.org/download.html It has been reported that Windows 2000 SP3 resolves this issue for IIS 5.0. This has not been confirmed. It is, however, recommended that administrators install all security fixes as a general practice. Microsoft has released patches from some products. Patches for other Microsoft products are reported by the vendor to be forthcoming. This issue has been addressed in Microsoft Internet Explorer Macintosh Edition version 5.2.2, which may be downloaded from Microsoft or obtained using Software Update. Microsoft has released new patches for users who installed Internet Explorer 6 on Windows 2000 systems with Service Pack 4 already installed. Conectiva has released an advisory, and a set of updated RPMs for KDE packages. Administrators are advised to update all packages to KDE 3.0.3. A comprehensive list of packages affected is available in the referenced Conectiva advisory. This issue is resolved in KDE and Konqueror 3.0.3. A patch has also been provided for users of KDE and Konqueror 2.2.2. RedHat has released an advisory, RHSA-2002:220-40, that contains many fixes. Information about obtaining and applying fixes are available in the referenced advisory. BEA Systems has released advisory BEA03-31.00 and made fixes available to address this issue. Users of affected 6.1 versions should upgrade to Service Pack 5. Users of affected 7.0 and 7.0.0.1 versions should upgrade to Service Pack 2. The following fixes are available: Microsoft Windows NT Terminal Server 4.0 SP6
Microsoft Windows XP Professional
Microsoft Windows NT Workstation 4.0 SP6a Microsoft Windows 2000 Advanced Server SP4
KDE Konqueror 2.2.2
KDE KDE 2.2.2
BEA Systems WebLogic Enterprise 5.0.1
BEA Systems WebLogic Express 5.1 SP 8
BEA Systems WebLogic Server for Win32 5.1 SP 5
BEA Systems WebLogic Enterprise 5.1
BEA Systems WebLogic Express for Win32 5.1 SP 2
BEA Systems WebLogic Server for Win32 5.1 SP 7
BEA Systems WebLogic Express 5.1 SP 11
BEA Systems WebLogic Server for Win32 5.1 SP 12
BEA Systems WebLogic Express for Win32 5.1 SP 7
BEA Systems WebLogic Express 5.1 SP 12
BEA Systems WebLogic Express for Win32 5.1 SP 12
BEA Systems WebLogic Server for Win32 5.1 SP 4
BEA Systems Weblogic Server 5.1 SP 10
BEA Systems Weblogic Server 5.1 SP 2
BEA Systems WebLogic Server for Win32 5.1 SP 3
BEA Systems WebLogic Express for Win32 5.1 SP 4
BEA Systems WebLogic Express 5.1 SP 13
BEA Systems WebLogic Express for Win32 5.1 SP 6
BEA Systems WebLogic Express 5.1 SP 2
BEA Systems Weblogic Server 5.1 SP 11
BEA Systems WebLogic Express 5.1 SP 1
BEA Systems Weblogic Server 5.1 SP 9
BEA Systems Weblogic Server 5.1 SP 5
BEA Systems WebLogic Server for Win32 5.1 SP 10
BEA Systems WebLogic Express 5.1 SP 6
BEA Systems WebLogic Express 5.1 SP 3
BEA Systems Weblogic Server 5.1 SP 3
BEA Systems Tuxedo 8.0
|
|
 Privacy Statement |
