Ubuntu 12.04 LTS: USN-2127-1 Critical: GnuTLS Man-In-The-Middle Risk

ubuntu

March 4, 2014

Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.

Summary

Fraudulent security certificates could allow sensitive information to

be exposed when accessing the Internet.

Software Description:

- gnutls26: GNU TLS library

Details:

Nikos Mavrogiannopoulos discovered that GnuTLS incorrectly handled

certificate verification functions. If a remote attacker were able to

perform a man-in-the-middle attack, this flaw could be exploited with

specially crafted certificates to view sensitive information.

Topics Covered

security advisory Ubuntu man-in-the-middle GnuTLS sensitivity exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
  libgnutls26                     2.12.23-1ubuntu4.2

Ubuntu 12.10:
  libgnutls26                     2.12.14-5ubuntu4.6

Ubuntu 12.04 LTS:
  libgnutls26                     2.12.14-5ubuntu3.7

Ubuntu 10.04 LTS:
  libgnutls26                     2.8.5-2ubuntu0.5

In general, a standard system update will make all the necessary changes.