==========================================================================
Ubuntu Security Notice USN-2385-1
October 16, 2014
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS
– Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in OpenSSL.
Software Description:
– openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
It was discovered that OpenSSL incorrectly handled memory when parsing
DTLS SRTP extension data. A remote attacker could possibly use this issue
to cause OpenSSL to consume resources, resulting in a denial of service.
This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
(CVE-2014-3513)
It was discovered that OpenSSL incorrectly handled memory when verifying
the integrity of a session ticket. A remote attacker could possibly use
this issue to cause OpenSSL to consume resources, resulting in a denial of
service. (CVE-2014-3567)
In addition, this update introduces support for the TLS Fallback Signaling
Cipher Suite Value (TLS_FALLBACK_SCSV). This new feature prevents protocol
downgrade attacks when certain applications such as web browsers attempt
to reconnect using a lower protocol version for interoperability reasons.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.7
Ubuntu 12.04 LTS:
libssl1.0.0 1.0.1-4ubuntu5.20
Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.22
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2385-1
CVE-2014-3513, CVE-2014-3567
Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.7
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.20
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.22
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJUP/PeAAoJEGVp2FWnRL6TPmYP/0U2qgQ5ZWO/S3qy9v3n2ky6
R5iy+UwPSptvgf/J/pCL0Ryt2F0/qjGd8tQp1VoGPYn1bm3Anl6lI4PCySyWKkVg
Wi5XxXbtllA2GWzy+vlYATXGA+eoNdgWf+c45+44Wg9JIm9GAzwXSmcERFOrRQW+
kU6MK5uYVmZaroa5LLO6QSWn1XMKhwBdcUDyYyUboqQeZrD5D7oP37tFNrBrVrGU
8yWjm2qYdHQ6+64YM6s6Ghwcy7Twq8AIODEfbFCOJP2QbN7kd+zF18lKRuKE4MBF
s7BYJSL4x9lS7ElfW6W9ZRu6yiCXFUNcW0Wjp1oriuS5SJdmuyH8n+8sq7MqOpar
QDxVcTngSoih/IAjfpsIO5mcY7GDoUYzqEX698JlHFqy+r3RXUE74TGXce1zXtY/
JyriZRKfsHBSZnwYNXAL+gp0ZRGVX+A+LCzN+KuFF37CCgxdpfr3P2IY7Hd7uMjn
2grd5WXe7E/MTIWjlA6WTxEhqheCWSdYAkco7NjNkkBpVRuh3HtWOgTxAXP1X7I2
waOf6at8ymvbHWAjAV4DwxZzyTbpjWNqNZ5hDp0BX1w4lj4PjpI/TedbphIipane
dfM+RMDmiPWZr8oyNmFDNM1+ZZHCVJo/t2pDLDQjyjEV068zyLamjpTLl4MHVE7Y
HwUn9webIgxoeUpo43H6
=u5zH
—–END PGP SIGNATURE—–
—
