Ubuntu 14.04 LTS: USN-2192-2 Moderate Fix for OpenSSL DoS Vulnerability

ubuntu

May 5, 2014

OpenSSL could be made to crash if it received specially crafted network traffic.

Summary

OpenSSL could be made to crash if it received specially crafted network

traffic.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL incorrectly handled memory in the

ssl3_read_bytes() function. A remote attacker could use this issue to

possibly cause OpenSSL to crash, resulting in a denial of service.

(CVE-2010-5298)

It was discovered that OpenSSL incorrectly handled memory in the

do_ssl3_write() function. A remote attacker could use this issue to

possibly cause OpenSSL to crash, resulting in a denial of service.

(CVE-2014-0198)

Topics Covered

security advisory denial of service Ubuntu OpenSSL network threat

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.1

Ubuntu 13.10:
  libssl1.0.0                     1.0.1e-3ubuntu1.3

Ubuntu 12.10:
  libssl1.0.0                     1.0.1c-3ubuntu2.8

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.13

After a standard system update you need to reboot your computer to make all
the necessary changes.