Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 499
Alerts This Week
Warning Icon 1 499

Ubuntu 16.04 LTS USN-4267-1: Moderate Mbedtls Denial of Service Threats

ubuntu
Calendar Grey February 5, 2020
Scroller Ubuntu
Numerous vulnerabilities concerning OpenSSL have been resolved in Ubuntu 20.04 LTS, enhancing overall security.
Several security issues were fixed in mbedtls.

Summary

Several security issues were fixed in mbedtls.

Software Description:

- mbedtls: lightweight crypto and SSL/TLS library - crypto library

Details:

It was discovered that mbedtls has a bounds-check bypass through an integer

overflow that can be used by an attacked to execute arbitrary code or cause a

denial of service.

(CVE-2017-18187)

It was discovered that mbedtls has a vulnerability where an attacker could

execute arbitrary code or cause a denial of service (buffer overflow)

via a crafted certificate chain that is mishandled during RSASSA-PSS

signature verification within a TLS or DTLS session.

(CVE-2018-0487)

It was discovered that mbedtls has a vulnerability where an attacker could

execute arbitrary code or cause a denial of service (heap corruption) via a

crafted application packet within a TLS or DTLS session.

(CVE-2018-0488)

It was discovered that mbedtls has a vulnerability that allows remote

attackers to achieve partial plaintext recovery (for a CBC based ciphersuite)

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow Ubuntu side-channel attack mbedtls

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libmbedcrypto0                  2.2.1-2ubuntu0.3
  libmbedtls10                    2.2.1-2ubuntu0.3
  libmbedx509-0                   2.2.1-2ubuntu0.3

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-4267-1

CVE-2017-18187, CVE-2018-0487, CVE-2018-0488, CVE-2018-0497,

CVE-2018-0498

February 05, 2020

Topics%20covered

Topics Covered

security advisory denial of service buffer overflow Ubuntu side-channel attack mbedtls

Package Information

https://launchpad.net/ubuntu/+source/mbedtls/2.2.1-2ubuntu0.3

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.