Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Ubuntu 14.04 LTS: USN-2315-1 Moderate: Serf Man In The Middle Attack

ubuntu
Calendar Grey August 14, 2014
Scroller Ubuntu
Deceptive encryption keys in serf may jeopardize confidential data, impacting Debian 8 and 7 releases.
Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.

Summary

Fraudulent security certificates could allow sensitive information to

be exposed when accessing the Internet.

Software Description:

- serf: high-performance asynchronous HTTP client library

Details:

Ben Reser discovered that serf did not correctly handle SSL certificates

with NUL bytes in the CommonName or SubjectAltNames fields. A remote

attacker could exploit this to perform a man in the middle attack to view

sensitive information or alter encrypted communications.

Topics%20covered

Topics Covered

security advisory ubuntu sensitive information man in the middle serf

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libserf-1-1                     1.3.3-1ubuntu0.1

Ubuntu 12.04 LTS:
  libserf1                        1.0.0-2ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2315-1

CVE-2014-3504

Severity
important
Lowest
Low
Medium
High
Critical

August 14, 2014

Topics%20covered

Topics Covered

security advisory ubuntu sensitive information man in the middle serf

Package Information

https://launchpad.net/ubuntu/+source/serf/1.3.3-1ubuntu0.1
https://launchpad.net/ubuntu/+source/serf/1.0.0-2ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.