You are here
Home > Preporuke > Sigurnosni nedostaci programskog paketa openssl

Sigurnosni nedostaci programskog paketa openssl

  • Detalji os-a: WN7
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LUB

==========================================================================
Ubuntu Security Notice USN-2232-4
August 18, 2014

openssl vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 10.04 LTS

Summary:

USN-2232-1 introduced a regression in OpenSSL.

Software Description:
– openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

USN-2232-1 fixed vulnerabilities in OpenSSL. One of the patch backports for
Ubuntu 10.04 LTS caused a regression for certain applications. This update
fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS
fragments. A remote attacker could use this issue to cause OpenSSL to
crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and
Ubuntu 14.04 LTS. (CVE-2014-0195)
Imre Rad discovered that OpenSSL incorrectly handled DTLS recursions. A
remote attacker could use this issue to cause OpenSSL to crash, resulting
in a denial of service. (CVE-2014-0221)
KIKUCHI Masashi discovered that OpenSSL incorrectly handled certain
handshakes. A remote attacker could use this flaw to perform a
man-in-the-middle attack and possibly decrypt and modify traffic.
(CVE-2014-0224)
Felix Gröbert and Ivan Fratrić discovered that OpenSSL incorrectly handled
anonymous ECDH ciphersuites. A remote attacker could use this issue to
cause OpenSSL to crash, resulting in a denial of service. This issue only
affected Ubuntu 12.04 LTS, Ubuntu 13.10, and Ubuntu 14.04 LTS.
(CVE-2014-3470)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.21

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2232-4
http://www.ubuntu.com/usn/usn-2232-1
https://launchpad.net/bugs/1356843

Package Information:
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.21

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIcBAEBCgAGBQJT8kgQAAoJEGVp2FWnRL6T6kQP/1WuiZIuV7pUGFQPktjTjh7w
OCXRuH4PUQsh8Wo1vV4TvWn1RIkkFucwwm9lTRffe3RWGsiTPyETCPFRjmidA92y
QLLGquv4Bay/WJoV1jTpP/4UjE+BgY7ok3z4IXg7jRcc3unjyHfHawP/KMI932sz
zKJHULQ4sOvSlTErmy/tQtZ6ZykNvVkpTlGVt9/vw42NuOGp4u0FI+n6xtZhV8bB
hHbHNcmSuQZrbRo4ojVyK2cm0crPhPd+lEDWIuvHIzd+8Ma1WsYzIkErusCVF4xO
2gKmXaKotPz0Bds5O2Ezf3/SU5DHmAXgyIUi1Wp2YoPURgqcctCNRPOkHUxjfrM+
OgdJ3p4vMvBQAQ8sh3n2YHuYaiVKxRPN9++FIke3GtmJqDT7gWBgY8S/FGGfvETz
xym2nRvrBUrBp170tTLHIRvCWEDCQT0XVXiwt6XTYh6FB2HBkrtnYshMQ+Dzbbkp
KxUWNshTqLMVxgFK1102ITmp7AA6B+3Vl4njH2Eno/RruUMNspM2D3XowaGkpH3H
bXg9FAXo46fNErn/TJYA7iSS/dBCjqgsKOB2HP00I7po+G7itp1GbTDZbYHu6nBi
NRZWxyDFsEi3NA6eVtoP7jZ+CLek+wqdlF+NtU5ufl+QZSPHgKRwoz1vq6cSTk+j
bpo656nEOCkF61xnVfMi
=0Iza
—–END PGP SIGNATURE—–

AutorMarijo Plepelic
Cert idNCERT-REF-2014-08-0037-ADV
CveCERT-CVE-DUMMY
ID izvornikaCERT-ORIGID-DUMMY
ProizvodCERT-DUMMY-PRODUCT
Izvorhttp://www.adobe.com/
Top
More in Preporuke
Sigurnosni nedostaci programskog paketa libpng

Otkriveni su sigurnosni nedostaci u programskom paketu libpng za operacijski sustav Gentoo. Otkriveni nedostaci potencijalnim napadačima omogućuju izvođenje napada uskraćivanja...

Close