Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 14.04 LTS: USN-2294-1 Critical: Libtasn1 DoS Exploit

ubuntu
Calendar Grey July 22, 2014
Scroller Ubuntu
Flaw in Libtasn1 could result in system crashes or arbitrary code execution on Debian systems when processing specially crafted data.
Libtasn1 could be made to crash or run programs as your login if it processed specially crafted data.

Summary

Libtasn1 could be made to crash or run programs as your login if it

processed specially crafted data.

Software Description:

- libtasn1-6: Library to manage ASN.1 structures

- libtasn1-3: Library to manage ASN.1 structures

Details:

It was discovered that Libtasn1 incorrectly handled certain ASN.1 data

structures. An attacker could exploit this with specially crafted ASN.1

data and cause applications using Libtasn1 to crash, resulting in a denial

of service. (CVE-2014-3467)

It was discovered that Libtasn1 incorrectly handled negative bit lengths.

An attacker could exploit this with specially crafted ASN.1 data and cause

applications using Libtasn1 to crash, resulting in a denial of service, or

possibly execute arbitrary code. (CVE-2014-3468)

It was discovered that Libtasn1 incorrectly handled certain ASN.1 data. An

attacker could exploit this with specially crafted ASN.1 data and cause

applications using Libtasn1 to crash, resulting in a denial of service.

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical software update ubuntu libtasn1 asn.1

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libtasn1-6                      3.4-3ubuntu0.1

Ubuntu 12.04 LTS:
  libtasn1-3                      2.10-1ubuntu1.2

Ubuntu 10.04 LTS:
  libtasn1-3                      2.4-1ubuntu0.2

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2294-1

CVE-2014-3467, CVE-2014-3468, CVE-2014-3469

Severity
critical
Lowest
Low
Medium
High
Critical

July 22, 2014

Topics%20covered

Topics Covered

security advisory denial of service critical software update ubuntu libtasn1 asn.1

Package Information

https://launchpad.net/ubuntu/+source/libtasn1-6/3.4-3ubuntu0.1
https://launchpad.net/ubuntu/+source/libtasn1-3/2.10-1ubuntu1.2
https://launchpad.net/ubuntu/+source/libtasn1-3/2.4-1ubuntu0.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.