Ubuntu 14.04 LTS: 2229-1 Critical GnuTLS Remote Code Exec Threat

ubuntu

June 2, 2014

GnuTLS could be made to crash or run programs if it connected to a malicious server.

Summary

GnuTLS could be made to crash or run programs if it connected to a

malicious server.

Software Description:

- gnutls26: GNU TLS library

Details:

Joonas Kuorilehto discovered that GnuTLS incorrectly handled Server Hello

messages. A malicious remote server or a man in the middle could use this

issue to cause GnuTLS to crash, resulting in a denial of service, or

possibly execute arbitrary code.

Topics Covered

security advisory denial of service security issue remote code exec ubuntu gnutls crash

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libgnutls26                     2.12.23-12ubuntu2.1

Ubuntu 13.10:
  libgnutls26                     2.12.23-1ubuntu4.3

Ubuntu 12.04 LTS:
  libgnutls26                     2.12.14-5ubuntu3.8

Ubuntu 10.04 LTS:
  libgnutls26                     2.8.5-2ubuntu0.6

In general, a standard system update will make all the necessary changes.