Ubuntu 16.04 LTS: 2959-1 Critical OpenSSL Denial Of Service Issues

ubuntu

May 3, 2016

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Huzaifa Sidhpurwala, Hanno Böck, and David Benjamin discovered that OpenSSL

incorrectly handled memory when decoding ASN.1 structures. A remote

attacker could use this issue to cause OpenSSL to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2016-2108)

Juraj Somorovsky discovered that OpenSSL incorrectly performed padding when

the connection uses the AES CBC cipher and the server supports AES-NI. A

remote attacker could possibly use this issue to perform a padding oracle

attack and decrypt traffic. (CVE-2016-2107)

Guido Vranken discovered that OpenSSL incorrectly handled large amounts of

input data to the EVP_EncodeUpdate() function. A remote attacker could use

this issue to cause OpenSSL to crash, resulting in a denial of service, or

possibly execute arbitrary code. (CVE-2016-...

Read the Full Advisory

Topics Covered

security advisory denial of service critical issue ubuntu openssl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libssl1.0.0                     1.0.2g-1ubuntu4.1

Ubuntu 15.10:
  libssl1.0.0                     1.0.2d-0ubuntu1.5

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.19

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.36

After a standard system update you need to reboot your computer to make
all the necessary changes.