Ubuntu 12.10 LTS NSPR Update USN-1763-2: Critical Timing Attack

ubuntu

March 14, 2013

NSPR update to work with the new NSS.

Summary

NSPR update to work with the new NSS.

Software Description:

- nspr: NetScape Portable Runtime Library

Details:

USN-1763-1 fixed a vulnerability in NSS. This update provides the NSPR

needed to use the new NSS.

Original advisory details:

Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as used

in NSS was vulnerable to a timing side-channel attack known as the

"Lucky Thirteen" issue. A remote attacker could use this issue to perform

plaintext-recovery attacks via analysis of timing data.

Topics Covered

security advisory remote access software fix timing attack ubuntu nspr update

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  libnspr4                        4.9.5-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  libnspr4                        4.9.5-0ubuntu0.12.04.1

Ubuntu 11.10:
  libnspr4                        4.9.5-0ubuntu0.11.10.1

Ubuntu 10.04 LTS:
  libnspr4-0d                     4.9.5-0ubuntu0.10.04.1

After a standard system update you need to restart any applications that
use NSPR, such as Evolution and Chromium, to make all the necessary changes.