==========================================================================
Ubuntu Security Notice USN-2232-3
June 23, 2014
openssl regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 LTS
– Ubuntu 13.10
– Ubuntu 12.04 LTS
– Ubuntu 10.04 LTS
Summary:
USN-2232-1 introduced a regression in OpenSSL.
Software Description:
– openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
USN-2232-1 fixed vulnerabilities in OpenSSL. The upstream fix for
CVE-2014-0224 caused a regression for certain applications that use
renegotiation, such as PostgreSQL. This update fixes the problem.
Original advisory details:
Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS
fragments. A remote attacker could use this issue to cause OpenSSL to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and
Ubuntu 14.04 LTS. (CVE-2014-0195)
Imre Rad discovered that OpenSSL incorrectly handled DTLS recursions. A
remote attacker could use this issue to cause OpenSSL to crash, resulting
in a denial of service. (CVE-2014-0221)
KIKUCHI Masashi discovered that OpenSSL incorrectly handled certain
handshakes. A remote attacker could use this flaw to perform a
man-in-the-middle attack and possibly decrypt and modify traffic.
(CVE-2014-0224)
Felix Gröbert and Ivan Fratrić discovered that OpenSSL incorrectly handled
anonymous ECDH ciphersuites. A remote attacker could use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS.
(CVE-2014-3470)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.4
Ubuntu 13.10:
libssl1.0.0 1.0.1e-3ubuntu1.6
Ubuntu 12.04 LTS:
libssl1.0.0 1.0.1-4ubuntu5.16
Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.19
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2232-3
http://www.ubuntu.com/usn/usn-2232-1
https://launchpad.net/bugs/1332643
Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.4
https://launchpad.net/ubuntu/+source/openssl/1.0.1e-3ubuntu1.6
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.16
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.19
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird – http://www.enigmail.net/
iQIcBAEBCgAGBQJTqB+JAAoJEGVp2FWnRL6TjhIQAKFXNnKFv3qmQgVZnDy7DjDV
i1a43jj5lKMbXcr/GBcBEheyMDv3zSeRy30nR/oQN7TDPWRVNgSL2tpGhDTTWLQL
T6XprcDUoZm/1tRv5AebJxI7wrdNNphZeeFuYt5cu+HiHjd0Og7ZMgnhR8En4X/F
/e8O/fPbgPC2Q8VLJZdNf6f8QGE1OsaYSJ0C8OYsLoj0FqDxE6y0QiKOT2k/w8eE
1XHAyU9MeNDiRscKF2mEIwIVBfd4Ql7dgHfcGLl8tf34sftoNCd1gTH/7NfaLzwS
zpgNVoT7hqp0WKsHqP/Uc24WHS94X7VKI+KcupfwUhmDRlqWZxLkWYYiFR9mVvk8
XIJ24gtPVDct/nycRoVbBdHn8k8Ex5z65nmuQcCCCNAfq8N19uZO5U0g8BrOY8gU
1C8STn8rL+1x9uqKzL9iKppaYNwj0qeudndxPZqvltphx5It+5pcIG8D27EcDEhd
LknyeAdtkHtD3q4xnHdmvELm44ORzVvp7uEbVyoo+P2vfizGXwMEhhJo15QJoSAx
Sq6Qli62xBa5pFc7nYjeXtWCRhgdww0Xgk+TTLLC0AKeGdj1uRLFlmbkJXE1p4iO
NlDw9w6moq3eimfYlR7vX0c/DIFjBNVhhGF7bWm05RrSxfRxL4cwMD4hTPtz5oZ+
GesgxPaWBxO60pp0GYB+
=+s0p
—–END PGP SIGNATURE—–
—
