Ubuntu 16.04 LTS: USN-2982-1 Critical: Libksba DoS Attack

ubuntu

May 17, 2016

Libksba could be made to crash or run programs if it decoded specially crafted data.

Summary

Libksba could be made to crash or run programs if it decoded specially

crafted data.

Software Description:

- libksba: X.509 and CMS support library

Details:

Hanno Böck discovered that Libksba incorrectly handled decoding certain BER

data. An attacker could use this issue to cause Libksba to crash, resulting

in a denial of service. This issue only applied to Ubuntu 12.04 LTS and

Ubuntu 14.04 LTS. (CVE-2016-4353)

Hanno Böck discovered that Libksba incorrectly handled decoding certain BER

data. An attacker could use this issue to cause Libksba to crash, resulting

in a denial of service, or possibly execute arbitrary code. This issue only

applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-4354,

CVE-2016-4355)

Hanno Böck discovered that Libksba incorrectly handled incorrect utf-8

strings when decoding certain DN data. An attacker could use this issue to

cause Libksba to crash, resulting in a denial of service, or possibly

execute arbitrary code. T...

Read the Full Advisory

Topics Covered

security advisory critical software update Ubuntu Denial of Service libksba

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libksba8                        1.3.3-1ubuntu0.16.04.1

Ubuntu 15.10:
  libksba8                        1.3.3-1ubuntu0.15.10.1

Ubuntu 14.04 LTS:
  libksba8                        1.3.0-3ubuntu0.14.04.2

Ubuntu 12.04 LTS:
  libksba8                        1.2.0-2ubuntu0.2

In general, a standard system update will make all the necessary changes.