U radu programskog paketa openssl otkrivena su i ispravljena dva sigurnosna propusta koje udaljeni napadač može iskoristiti za rušenje aplikacije ili otkrivanje osjetljivih informacija.
Paket:
OpenSSL 1.x
Operacijski sustavi:
Ubuntu Linux 8.04, Ubuntu Linux 10.04, Ubuntu Linux 11.04, Ubuntu Linux 11.10, Ubuntu Linux 12.04
Kritičnost:
4.4
Problem:
cjelobrojno prepisivanje, pogreška u programskoj komponenti
Propusti su posljedica pogrešaka u implementacijama Cryptographic Message Syntax (CMS) i PKCS #7, te cjelobrojnog podljeva kada se TLS 1.1, TLS 1.2, ili DTLS protokoli koriste sa CBC enkripcijom.
Posljedica:
Udaljeni napadač može iskoristiti navedene propuste za izvođenje DoS napada ili otkrivanje osjetljivih informacija putem MMA napada (eng. Million Message Attack).
Rješenje:
Kako bi se zaštitili, korisnicima se savjetuje korištenje odgovarajuće nadogradnje.
==========================================================================
Ubuntu Security Notice USN-1451-1
May 24, 2012
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS
Summary:
Applications using OpenSSL in certain situations could be made to
crash or expose sensitive information.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
Ivan Nestlerode discovered that the Cryptographic Message Syntax
(CMS) and PKCS #7 implementations in OpenSSL returned early if RSA
decryption failed. This could allow an attacker to expose sensitive
information via a Million Message Attack (MMA). (CVE-2012-0884)
It was discovered that an integer underflow was possible when using
TLS 1.1, TLS 1.2, or DTLS with CBC encryption. This could allow a
remote attacker to cause a denial of service. (CVE-2012-2333)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
libssl1.0.0 1.0.1-4ubuntu5.2
openssl 1.0.1-4ubuntu5.2
Ubuntu 11.10:
libssl1.0.0 1.0.0e-2ubuntu4.6
openssl 1.0.0e-2ubuntu4.6
Ubuntu 11.04:
libssl0.9.8 0.9.8o-5ubuntu1.7
openssl 0.9.8o-5ubuntu1.7
Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.13
openssl 0.9.8k-7ubuntu8.13
Ubuntu 8.04 LTS:
libssl0.9.8 0.9.8g-4ubuntu3.19
openssl 0.9.8g-4ubuntu3.19
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1451-1
CVE-2012-0884, CVE-2012-2333
Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.2
https://launchpad.net/ubuntu/+source/openssl/1.0.0e-2ubuntu4.6
https://launchpad.net/ubuntu/+source/openssl/0.9.8o-5ubuntu1.7
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.13
https://launchpad.net/ubuntu/+source/openssl/0.9.8g-4ubuntu3.19
Posljednje sigurnosne preporuke