Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 14.04 and 15.04 USN-2746-1 Critical Simple Streams Issue

ubuntu
Calendar Grey September 24, 2015
Scroller Ubuntu
=========================================================================Ubuntu Security Notice USN-
Applications using Simple Streams could be made to crash or runprograms if it received specially crafted network traffic.

Summary

Applications using Simple Streams could be made to crash or run

programs if it received specially crafted network traffic.

Software Description:

- simplestreams: Library and tools for using Simple Streams data

Details:

It was discovered that Simple Streams did not properly perform gpg

verification in some situations. A remote attacker could use this to

perform a man-in-the-middle attack and inject malicious content into

the stream.

Topics%20covered

Topics Covered

security advisory critical remote code execution man-in-the-middle attack ubuntu simple streams

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.04:
  python-simplestreams            0.1.0~bzr354-0ubuntu1.15.04.1
  python-simplestreams-openstack  0.1.0~bzr354-0ubuntu1.15.04.1
  python3-simplestreams           0.1.0~bzr354-0ubuntu1.15.04.1
  simplestreams                   0.1.0~bzr354-0ubuntu1.15.04.1

Ubuntu 14.04 LTS:
  python-simplestreams            0.1.0~bzr341-0ubuntu2.2
  python-simplestreams-openstack  0.1.0~bzr341-0ubuntu2.2
  python3-simplestreams           0.1.0~bzr341-0ubuntu2.2
  simplestreams                   0.1.0~bzr341-0ubuntu2.2

After a standard system update you need to restart any services that
make use of python-simplestreams or python3-simplestreams to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2746-1

CVE-2015-1337

Severity
critical
Lowest
Low
Medium
High
Critical

September 24, 2015

Topics%20covered

Topics Covered

security advisory critical remote code execution man-in-the-middle attack ubuntu simple streams

Package Information

https://launchpad.net/ubuntu/+source/simplestreams/0.1.0~bzr354-0ubuntu1.15.04.1
https://launchpad.net/ubuntu/+source/simplestreams/0.1.0~bzr341-0ubuntu2.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.