Ubuntu 16.10 USN-3181-1 Critical OpenSSL Denial of Service Threat

ubuntu

January 31, 2017

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Guido Vranken discovered that OpenSSL used undefined behaviour when

performing pointer arithmetic. A remote attacker could possibly use this

issue to cause OpenSSL to crash, resulting in a denial of service. This

issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS as other

releases were fixed in a previous security update. (CVE-2016-2177)

It was discovered that OpenSSL did not properly handle Montgomery

multiplication, resulting in incorrect results leading to transient

failures. This issue only applied to Ubuntu 16.04 LTS, and Ubuntu 16.10.

(CVE-2016-7055)

It was discovered that OpenSSL did not properly use constant-time

operations when performing ECDSA P-256 signing. A remote attacker could

possibly use this issue to perform a timing attack and recover private

ECDSA keys. This issue only applied to Ub...

Read the Full Advisory

Topics Covered

security advisory denial of service critical issue Ubuntu OpenSSL system update

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.10:
  libssl1.0.0                     1.0.2g-1ubuntu9.1

Ubuntu 16.04 LTS:
  libssl1.0.0                     1.0.2g-1ubuntu4.6

Ubuntu 14.04 LTS:
  libssl1.0.0                     1.0.1f-1ubuntu2.22

Ubuntu 12.04 LTS:
  libssl1.0.0                     1.0.1-4ubuntu5.39

After a standard system update you need to reboot your computer to make
all the necessary changes.