Ubuntu 13.10: 2088-1 Severe NSS Network Vulnerability Warning

ubuntu

January 23, 2014

NSS could be made to expose sensitive information over the network.

Summary

NSS could be made to expose sensitive information over the network.

Software Description:

- nss: Network Security Service library

Details:

Brian Smith discovered that NSS incorrectly handled the TLS False Start

feature. If a remote attacker were able to perform a man-in-the-middle

attack, this flaw could be exploited to spoof SSL servers.

Topics Covered

security advisory critical Ubuntu network attack data leak NSS

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  libnss3                         2:3.15.4-0ubuntu0.13.10.1

Ubuntu 12.10:
  libnss3                         3.15.4-0ubuntu0.12.10.1

Ubuntu 12.04 LTS:
  libnss3                         3.15.4-0ubuntu0.12.04.1

Ubuntu 10.04 LTS:
  libnss3-1d                      3.15.4-0ubuntu0.10.04.1

After a standard system update you need to restart any applications that
use NSS, such as Evolution and Chromium, to make all the necessary changes.