==========================================================================
Ubuntu Security Notice USN-3450-1
October 11, 2017

openvswitch vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 17.04
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Open vSwitch.

Software Description:
– openvswitch: Ethernet virtual switch

Details:

Bhargava Shastry discovered that Open vSwitch incorrectly handled certain
OFP messages. A remote attacker could possibly use this issue to cause
Open vSwitch to crash, resulting in a denial of service. (CVE-2017-9214)

It was discovered that Open vSwitch incorrectly handled certain OpenFlow
role messages. A remote attacker could possibly use this issue to cause
Open vSwitch to crash, resulting in a denial of service. (CVE-2017-9263)

It was discovered that Open vSwitch incorrectly handled certain malformed
packets. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. This issue only
affected Ubuntu 17.04. (CVE-2017-9264)

It was discovered that Open vSwitch incorrectly handled group mod OpenFlow
messages. A remote attacker could possibly use this issue to cause Open
vSwitch to crash, resulting in a denial of service. (CVE-2017-9265)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
openvswitch-common 2.6.1-0ubuntu5.1

Ubuntu 16.04 LTS:
openvswitch-common 2.5.2-0ubuntu0.16.04.2

In general, a standard system update will make all the necessary changes.

References:
https://www.ubuntu.com/usn/usn-3450-1
CVE-2017-9214, CVE-2017-9263, CVE-2017-9264, CVE-2017-9265

Package Information:
https://launchpad.net/ubuntu/+source/openvswitch/2.6.1-0ubuntu5.1
https://launchpad.net/ubuntu/+source/openvswitch/2.5.2-0ubuntu0.16.04.2

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v2

iQIcBAEBCgAGBQJZ3huVAAoJEGVp2FWnRL6TVHwQAJW1qF0OiF8XFooUtQ42KW1N
JPkAV1koYNsEH5k4Wmmcx8Se5yeLJ3G2HijIBXYijvIq8/nLJ+D2lOV0L95CTVH7
tI05dLETwMO1JmymxGTBJeUCmoyyYMmoJT3TliCRUNxBp9XjWon2QfxOkaVnvsEY
zS6pdYHQFguzvCs48Lq7Sgoug0cEDa9AJRn46Mxr9Nx3eluUhbaq1JM834XHTmyN
DiqYcrnir5C/qKD2QpljXCnduxtwvEWzFHvr+DuhSXWQRhs+5TQjpp3tF+27izsv
dtMnadY2yJG/F/7/fBKSd5k/IGeDsDLRgzGQmzz5yFIY41mbE+pI71OxPMOosRYg
+FSUqireASYMtZb084e1br9n6sEPCzCYrZXBOmuQtSp6uMg9uuMhn0TIvHyjGHvM
0InGwqzi08E4CUVxET/Dd2h1pdBQaViL31xdn4fhQpj++CFX5gTSCADPlXk0CUNC
X/j6ECURxMtM5X4cyHAsLn83FNt3kXz6SuGnoybioIsk5NkLUvSj1ChOyEd5Lw5O
C1Tbjf6uobGd6DPz1rMozI+ihMYddwvolAugGFP4S1U0PifUvQJ7opcbygZ7U9Gz
ON3FEQp8Y9jlDk56T5xBeVnZFM5zB64udAXXl2cLubWdBB5jXSUN9qmDT2gVdu3l
ZgchD78QwrTB49v8EzXq
=cafp
—–END PGP SIGNATURE—–
—