Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 16.04 LTS USN-3087-1 Critical: OpenSSL Denial of Service

ubuntu
Calendar Grey September 22, 2016
Scroller Ubuntu
Multiple OpenSSL vulnerabilities in Ubuntu can result in service disruptions; critical patches made available for various long-term support releases.
Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Shi Lei discovered that OpenSSL incorrectly handled the OCSP Status Request

extension. A remote attacker could possibly use this issue to cause memory

consumption, resulting in a denial of service. (CVE-2016-6304)

Guido Vranken discovered that OpenSSL used undefined behaviour when

performing pointer arithmetic. A remote attacker could possibly use this

issue to cause OpenSSL to crash, resulting in a denial of service. This

issue has only been addressed in Ubuntu 16.04 LTS in this update.

(CVE-2016-2177)

César Pereida, Billy Brumley, and Yuval Yarom discovered that OpenSSL

did not properly use constant-time operations when performing DSA signing.

A remote attacker could possibly use this issue to perform a cache-timing

attack and recover private DSA keys. (CVE-2016-2178)

Quan Luo discovered that OpenSSL did n...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu openssl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libssl1.0.0                     1.0.2g-1ubuntu4.4

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.20

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.37

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3087-1

CVE-2016-2177, CVE-2016-2178, CVE-2016-2179, CVE-2016-2180,

CVE-2016-2181, CVE-2016-2182, CVE-2016-2183, CVE-2016-6302,

CVE-2016-6303, CVE-2016-6304, CVE-2016-6306

Severity
critical
Lowest
Low
Medium
High
Critical

September 22, 2016

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu openssl

Package Information

https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.4
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.20
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.37

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.