==========================================================================
Ubuntu Security Notice USN-2232-4
August 18, 2014
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 10.04 LTS
Summary:
USN-2232-1 introduced a regression in OpenSSL.
Software Description:
– openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
USN-2232-1 fixed vulnerabilities in OpenSSL. One of the patch backports for
Ubuntu 10.04 LTS caused a regression for certain applications. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS
fragments. A remote attacker could use this issue to cause OpenSSL to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and
Ubuntu 14.04 LTS. (CVE-2014-0195)
Imre Rad discovered that OpenSSL incorrectly handled DTLS recursions. A
remote attacker could use this issue to cause OpenSSL to crash, resulting
in a denial of service. (CVE-2014-0221)
KIKUCHI Masashi discovered that OpenSSL incorrectly handled certain
handshakes. A remote attacker could use this flaw to perform a
man-in-the-middle attack and possibly decrypt and modify traffic.
(CVE-2014-0224)
Felix Gröbert and Ivan Fratrić discovered that OpenSSL incorrectly handled
anonymous ECDH ciphersuites. A remote attacker could use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS.
(CVE-2014-3470)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.21
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2232-4
http://www.ubuntu.com/usn/usn-2232-1
https://launchpad.net/bugs/1356843
Package Information:
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.21
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJT8kgQAAoJEGVp2FWnRL6T6kQP/1WuiZIuV7pUGFQPktjTjh7w
OCXRuH4PUQsh8Wo1vV4TvWn1RIkkFucwwm9lTRffe3RWGsiTPyETCPFRjmidA92y
QLLGquv4Bay/WJoV1jTpP/4UjE+BgY7ok3z4IXg7jRcc3unjyHfHawP/KMI932sz
zKJHULQ4sOvSlTErmy/tQtZ6ZykNvVkpTlGVt9/vw42NuOGp4u0FI+n6xtZhV8bB
hHbHNcmSuQZrbRo4ojVyK2cm0crPhPd+lEDWIuvHIzd+8Ma1WsYzIkErusCVF4xO
2gKmXaKotPz0Bds5O2Ezf3/SU5DHmAXgyIUi1Wp2YoPURgqcctCNRPOkHUxjfrM+
OgdJ3p4vMvBQAQ8sh3n2YHuYaiVKxRPN9++FIke3GtmJqDT7gWBgY8S/FGGfvETz
xym2nRvrBUrBp170tTLHIRvCWEDCQT0XVXiwt6XTYh6FB2HBkrtnYshMQ+Dzbbkp
KxUWNshTqLMVxgFK1102ITmp7AA6B+3Vl4njH2Eno/RruUMNspM2D3XowaGkpH3H
bXg9FAXo46fNErn/TJYA7iSS/dBCjqgsKOB2HP00I7po+G7itp1GbTDZbYHu6nBi
NRZWxyDFsEi3NA6eVtoP7jZ+CLek+wqdlF+NtU5ufl+QZSPHgKRwoz1vq6cSTk+j
bpo656nEOCkF61xnVfMi
=0Iza
—–END PGP SIGNATURE—–
—
