Ubuntu 15.10 USN-2830-1 Important OpenSSL Denial of Service Vulnerability

ubuntu

December 7, 2015

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Guy Leaver discovered that OpenSSL incorrectly handled a ServerKeyExchange

for an anonymous DH ciphersuite with the value of p set to 0. A remote

attacker could possibly use this issue to cause OpenSSL to crash, resulting

in a denial of service. This issue only applied to Ubuntu 15.10.

(CVE-2015-1794)

Hanno Böck discovered that the OpenSSL Montgomery squaring procedure

algorithm may produce incorrect results when being used on x86_64. A remote

attacker could possibly use this issue to break encryption. This issue only

applied to Ubuntu 15.10. (CVE-2015-3193)

Loïc Jonas Etienne discovered that OpenSSL incorrectly handled ASN.1

signatures with a missing PSS parameter. A remote attacker could possibly

use this issue to cause OpenSSL to crash, resulting in a denial of service.

(CVE-2015-3194)

Adam Langley disc...

Read the Full Advisory

Topics Covered

security advisory denial of service security issue Ubuntu critical update OpenSSL

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  libssl1.0.0                     1.0.2d-0ubuntu1.2

Ubuntu 15.04:
  libssl1.0.0                     1.0.1f-1ubuntu11.5

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.16

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.32

After a standard system update you need to reboot your computer to make
all the necessary changes.