Ubuntu 13.10: 2063-1 Critical: NSS Man-In-The-Middle Risk

ubuntu

December 20, 2013

Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.

Summary

Fraudulent security certificates could allow sensitive information to

be exposed when accessing the Internet.

Software Description:

- nss: Network Security Service library

Details:

It was discovered that an intermediate certificate was incorrectly issued

by a subordinate certificate authority of a trusted CA included in NSS.

This intermediate certificate could be used in a man-in-the-middle attack,

and has such been marked as untrusted in this update.

Topics Covered

security advisory critical information exposure ubuntu man-in-the-middle nss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  libnss3                         2:3.15.3.1-0ubuntu0.13.10.1

Ubuntu 13.04:
  libnss3                         2:3.15.3.1-0ubuntu0.13.04.1

Ubuntu 12.10:
  libnss3                         3.15.3.1-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  libnss3                         3.15.3.1-0ubuntu0.12.04.1

Ubuntu 10.04 LTS:
  libnss3-1d                      3.15.3.1-0ubuntu0.10.04.1

After a standard system update you need to restart any applications that
use NSS, such as Evolution and Chromium, to make all the necessary changes.