Ubuntu 14.04 LTS: USN-2232-1 Moderate: OpenSSL Denial Of Service

ubuntu

June 5, 2014

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Jüri Aedla discovered that OpenSSL incorrectly handled invalid DTLS

fragments. A remote attacker could use this issue to cause OpenSSL to

crash, resulting in a denial of service, or possibly execute arbitrary

code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 13.10, and

Ubuntu 14.04 LTS. (CVE-2014-0195)

Imre Rad discovered that OpenSSL incorrectly handled DTLS recursions. A

remote attacker could use this issue to cause OpenSSL to crash, resulting

in a denial of service. (CVE-2014-0221)

KIKUCHI Masashi discovered that OpenSSL incorrectly handled certain

handshakes. A remote attacker could use this flaw to perform a

man-in-the-middle attack and possibly decrypt and modify traffic.

(CVE-2014-0224)

Felix Gröbert and Ivan Fratrić discovered that OpenSSL incorrectly handled

anonymous ECDH ciphersuites. A r...

Read the Full Advisory

Topics Covered

security advisory moderate denial of service Ubuntu OpenSSL

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.2

Ubuntu 13.10:
  libssl1.0.0                     1.0.1e-3ubuntu1.4

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.14

Ubuntu 10.04 LTS:
  libssl0.9.8                     0.9.8k-7ubuntu8.18

After a standard system update you need to reboot your computer to make all
the necessary changes.