Ubuntu: USN-1763-1 Moderate: NSS Timing Side-Channel Attack

ubuntu

March 14, 2013

NSS could be made to expose sensitive information over the network.

Summary

NSS could be made to expose sensitive information over the network.

Software Description:

- nss: Network Security Service library

Details:

Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used

in NSS was vulnerable to a timing side-channel attack known as the

"Lucky Thirteen" issue. A remote attacker could use this issue to perform

plaintext-recovery attacks via analysis of timing data.

Topics Covered

security advisory timing attack exposure ubuntu network sensitive data nss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  libnss3                         3.14.3-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  libnss3                         3.14.3-0ubuntu0.12.04.1

Ubuntu 11.10:
  libnss3                         3.14.3-0ubuntu0.11.10.1

Ubuntu 10.04 LTS:
  libnss3-1d                      3.14.3-0ubuntu0.10.04.1

After a standard system update you need to restart any applications that
use NSS, such as Evolution and Chromium, to make all the necessary changes.