Gentoo Archives: gentoo-security

From: Phil Cryer <phil@×××××.us>
To: Troy Farrell <troy@×××××××××××.com>
Cc: gentoo-security@l.g.o, pcryer@×××××××××.com
Subject: Re: [gentoo-security] Re: [gentoo-announce] Gentoo Linux Security Advisory 200403-03: Multiple OpenSSL Vulnerabilities
Date: Thu, 18 Mar 2004 05:11:38
Message-Id: 32803.192.168.0.7.1079586681.squirrel@192.168.0.7
In Reply to: Re: [gentoo-security] Re: [gentoo-announce] Gentoo Linux Security Advisory 200403-03: Multiple OpenSSL Vulnerabilities by Troy Farrell
1 Troy Farrell said:
2 > Phil, I see one problem though I'm not sure I have the solution.
3 > The 'emerge sync' error is a python traceback. A temporary fix (enough to
4 > get
5 > it working long enough to fix it) might be to soft link your
6 > libssl.so.0.9.7 to
7 > libssl.so.0.9.6. You need to re-emerge python because of the +ssl USE
8 > flag. I
9 > can't say what the 'CANNOT IMPORT FTPLIB' error means.
10
11 Troy
12 Thanks for your quick response. After pouring through the forums, I did
13 the portage rescue deal, did ldconfig, nothing was working for me.
14 Eventually I did this:
15
16 cp /usr/lib/libssl.so.0.9.7 /usr/lib/libssl.so.0.9.6
17
18 and now I can emerge and all my apps run (I could run Firefox, but not
19 xfce4, and any other gtk based thing, plus on my server everything had
20 ground to a halt too!)
21
22 so, now it's 'working' but not fixed. when I try to do ssh it fails with:
23
24 ssh jorge -l root
25 OpenSSL version mismatch. Built against 9060bf, you have 90704f
26
27 I'm unsure what to do next, and I don't want to break things any further.
28 Also, I'm concerned that a simple security upgrade messed things up so
29 much (that's all I did was emerge openssl) perhaps I should have done the
30 updated 0.9.6 instead of the 0.9.7? If that's the case, maybe I can
31 unmerge 0.9.7 and re-emerge 0.9.6? or can I make 0.9.7 work?
32
33 /me heads back to the forums....
34
35 thanks
36 P
37 --
38 http://lefttochance.com/
39
40 --
41 gentoo-security@g.o mailing list

Replies