Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 14.04 LTS: USN-2821-1 Moderate: GnuTLS Padding Oracle Attack

ubuntu
Calendar Grey November 30, 2015
Scroller Ubuntu
OpenSSL flaw in Fedora may reveal confidential data online. Patch required for protection.
GnuTLS could be made to expose sensitive information over the network.

Summary

GnuTLS could be made to expose sensitive information over the network.

Software Description:

- gnutls26: GNU TLS library

Details:

It was discovered that GnuTLS incorrectly validated the first byte of

padding in CBC modes. A remote attacker could possibly use this issue to

perform a padding oracle attack.

Topics%20covered

Topics Covered

security advisory moderate update ubuntu gnutls network exposure padding oracle

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libgnutls26                     2.12.23-12ubuntu2.3

Ubuntu 12.04 LTS:
  libgnutls26                     2.12.14-5ubuntu3.10

In general, a standard system update will make all the necessary changes.

References

https://bugs.launchpad.net/ubuntu/+source/gnutls26/+bug/1510163

Severity
important
Lowest
Low
Medium
High
Critical

November 30, 2015

Topics%20covered

Topics Covered

security advisory moderate update ubuntu gnutls network exposure padding oracle

Package Information

https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-12ubuntu2.3
https://launchpad.net/ubuntu/+source/gnutls26/2.12.14-5ubuntu3.10

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.