exploit the possibilities

Ubuntu Security Notice USN-1424-1

Ubuntu Security Notice USN-1424-1
Posted Apr 20, 2012
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 1424-1 - It was discovered that OpenSSL could be made to dereference a NULL pointer when processing S/MIME messages. A remote attacker could use this to cause a denial of service. These issues did not affect Ubuntu 8.04 LTS. Tavis Ormandy discovered that OpenSSL did not properly perform bounds checking when processing DER data via BIO or FILE functions. A remote attacker could trigger this flaw in services that used SSL to cause a denial of service or possibly execute arbitrary code with application privileges. Various other issues were also addressed.

tags | advisory, remote, denial of service, arbitrary
systems | linux, ubuntu
advisories | CVE-2012-2110, CVE-2006-7250, CVE-2012-1165, CVE-2012-2110
MD5 | 30c74a9bf9fcc9686a5ad34f80b76b43

Ubuntu Security Notice USN-1424-1

Change Mirror Download
============================================================================
Ubuntu Security Notice USN-1424-1
April 19, 2012

openssl vulnerabilities
============================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
- Ubuntu 8.04 LTS

Summary:

An application using OpenSSL could be made to crash or run programs if it
opened a specially crafted file.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL could be made to dereference a NULL pointer
when processing S/MIME messages. A remote attacker could use this to cause
a denial of service. These issues did not affect Ubuntu 8.04 LTS.
(CVE-2006-7250, CVE-2012-1165)

Tavis Ormandy discovered that OpenSSL did not properly perform bounds
checking when processing DER data via BIO or FILE functions. A remote
attacker could trigger this flaw in services that used SSL to cause a
denial of service or possibly execute arbitrary code with application
privileges. (CVE-2012-2110)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
libssl1.0.0 1.0.0e-2ubuntu4.4

Ubuntu 11.04:
libssl0.9.8 0.9.8o-5ubuntu1.4

Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.10

Ubuntu 8.04 LTS:
libssl0.9.8 0.9.8g-4ubuntu3.17

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1424-1
CVE-2006-7250, CVE-2012-1165, CVE-2012-2110

Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.0e-2ubuntu4.4
https://launchpad.net/ubuntu/+source/openssl/0.9.8o-5ubuntu1.4
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.10
https://launchpad.net/ubuntu/+source/openssl/0.9.8g-4ubuntu3.17
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close