Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 443
Alerts This Week
Warning Icon 1 443

Ubuntu 14.04 LTS USN-3183-2 Critical: GnuTLS DoS Attack

ubuntu
Calendar Grey March 20, 2017
Dist Ubuntu Esm H88
GnuTLS flaw impacts Ubuntu versions 14.04 and 12.04, necessitating updates to prevent possible denial of service exploits.
GnuTLS could be made to hang if it received specially crafted network traffic.

Summary

GnuTLS could be made to hang if it received specially crafted network

traffic.

Software Description:

- gnutls26: GNU TLS library

Details:

USN-3183-1 fixed CVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu

16.10. This update provides the corresponding update for Ubuntu 12.04 LTS

and Ubuntu 14.04 LTS.

Original advisory details:

Stefan Buehler discovered that GnuTLS incorrectly verified the serial

length of OCSP responses. A remote attacker could possibly use this issue

to bypass certain certificate validation measures. This issue only applied

to Ubuntu 16.04 LTS. (CVE-2016-7444)

Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts.

A remote attacker could possibly use this issue to cause GnuTLS to hang,

resulting in a denial of service. This issue has only been addressed in

Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610)

It was discovered that GnuTLS incorrectly decoded X.509 certificates with a

Proxy Certificate I...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service ubuntu gnutls network issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  libgnutls26                     2.12.23-12ubuntu2.7

Ubuntu 12.04 LTS:
  libgnutls26                     2.12.14-5ubuntu3.14

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3183-2

https://ubuntu.com/security/notices/USN-3183-1

CVE-2016-8610

Severity
critical
Lowest
Low
Medium
High
Critical

March 20, 2017

Topics%20covered

Topics Covered

security advisory denial of service ubuntu gnutls network issue

Package Information

https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-12ubuntu2.7
https://launchpad.net/ubuntu/+source/gnutls26/2.12.14-5ubuntu3.14

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.