-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

IBM SECURITY ADVISORY

First Issued: Mon May 11 10:36:12 CDT 2009

The most recent version of this document is available here:

http://aix.software.ibm.com/aix/efixes/security/ssl_advisory.asc
or
ftp://aix.software.ibm.com/aix/efixes/security/ssl_advisory.asc

VULNERABILITY SUMMARY

VULNERABILITY: AIX OpenSSL 0.9.8.803 with Security Patches

PLATFORMS: AIX 5.2, 5.3, 6.1

SOLUTION: Apply the fix as described below.

THREAT: See below

CERT VU Number: n/a
CVE Numbers: CVE-2009-0590 CVE-2009-0591 CVE-2009-0789

DETAILED INFORMATION

I. DESCRIPTION

Three moderate severity security flaws have been fixed in OpenSSL
0.9.8k. The AIX version number is 0.9.8.803.

The function ASN1_STRING_print_ex() when used to print a BMPString
or UniversalString will crash with an invalid memory access if the
encoded length of the string is illegal. (CVE-2009-0590)

The function CMS_verify() does not correctly handle an error
condition involving malformed signed attributes. This will cause
an invalid set of signed attributes to appear valid and content
digests will not be checked. (CVE-2009-0591)

When a malformed ASN1 structure is received it's contents are
freed up and zeroed and an error condition returned. On a small
number of platforms where sizeof(long) < sizeof(void *) (for
example WIN64) this can cause an invalid memory access later
resulting in a crash when some invalid structures are read, for
example RSA public keys (CVE-2009-0789).

For more information about the three flaws, please visit:

http://www.openssl.org//news/secadv_20090325.txt

II. PLATFORM VULNERABILITY ASSESSMENT

To determine if your system is vulnerable, execute the following
command:

lslpp -L openssl.base

The following fileset levels are vulnerable:

AIX 6.1: all versions less than 0.9.8.803
AIX 5.3: all versions less than 0.9.8.803
AIX 5.2: all versions less than 0.9.8.803

III. FIXES

A fix is available, and it can be downloaded from:

https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp

IV. WORKAROUNDS

There are no workarounds.

V. CONTACT INFORMATION

If you would like to receive AIX Security Advisories via email,
please visit:

http://www.ibm.com/systems/support

and click on the "My notifications" link.

To view previously issued advisories, please visit:

http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd

Comments regarding the content of this announcement can be
directed to:

security-alert@austin.ibm.com

To obtain the PGP public key that can be used to communicate
securely with the AIX Security Team you can either:

A. Download the key from our web page:

http://www.ibm.com/systems/resources/systems_p_os_aix_security_pgpkey.txt

B. Download the key from a PGP Public Key Server. The key ID is:

0xADA6EB4D

Please contact your local IBM AIX support center for any
assistance.

eServer is a trademark of International Business Machines
Corporation. IBM, AIX and pSeries are registered trademarks of
International Business Machines Corporation. All other trademarks
are property of their respective holders.

VI. ACKNOWLEDGEMENTS

For acknowledgements and more information please visit:

http://www.openssl.org//news/secadv_20090325.txt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (AIX)

iD8DBQFKCFCaP9Qud62m600RAsAGAJ40bn9SUTAC9w1LufJ8BiAG6qnVNQCeOYs3
Cv27/3phuxgiaJN7loNKFuA=
=Qr0P
-----END PGP SIGNATURE-----