Ubuntu 14.04 LTS: USN-2059-2 Critical: wget Security Flaws

ubuntu

December 18, 2013

Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.

Summary

Fraudulent security certificates could allow sensitive information to be

exposed when accessing the Internet.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Marc Deslauriers discovered that libcurl incorrectly verified CN and SAN

name fields when digital signature verification was disabled in the GnuTLS

backend. When libcurl is being used in this uncommon way by specific

applications, an attacker could exploit this to perform a man in the middle

attack to view sensitive information or alter encrypted communications.

Topics Covered

security advisory update curl sensitive data man in the middle libcurl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  libcurl3-gnutls                 7.32.0-1ubuntu1.2

Ubuntu 13.04:
  libcurl3-gnutls                 7.29.0-1ubuntu3.4

Ubuntu 12.10:
  libcurl3-gnutls                 7.27.0-1ubuntu1.7

Ubuntu 12.04 LTS:
  libcurl3-gnutls                 7.22.0-3ubuntu4.6

In general, a standard system update will make all the necessary changes.