Mandrake Security Advisory MDVSA-2009:237 (openssl)

Summary
The remote host is missing an update to openssl announced via advisory MDVSA-2009:237.
Solution
To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:237
Insight
Multiple vulnerabilities was discovered and corrected in openssl: ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello (CVE-2009-1386). The NSS library library before 3.12.3, as used in Firefox GnuTLS before 2.6.4 and 2.7.4 OpenSSL 0.9.8 through 0.9.8k and other products support MD2 with X.509 certificates, which might allow remote attackers to spooof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large (CVE-2009-2409). This update provides a solution to these vulnerabilities. Affected: Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0