Ubuntu Security Notice 1687-1 - Two intermediate CA certificates were mis-issued by the TURKTRUST certificate authority. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information.
2c880fd754a63df7f4e2ab3b0fb2a8d3137ab98e86a46fe7a2f65b59f9d403e7
============================================================================
Ubuntu Security Notice USN-1687-1
January 14, 2013
nss vulnerability
============================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 11.10
- Ubuntu 10.04 LTS
Summary:
Fraudulent security certificates could allow sensitive information to
be exposed when accessing the Internet.
Software Description:
- nss: Network Security Service library
Details:
Two intermediate CA certificates were mis-issued by the TURKTRUST
certificate authority. If a remote attacker were able to perform a
man-in-the-middle attack, this flaw could be exploited to view sensitive
information.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.10:
libnss3-1d 3.14.1-0ckbi1.93ubuntu.0.12.10.1
Ubuntu 12.04 LTS:
libnss3-1d 3.14.1-0ckbi1.93ubuntu.0.12.04.1
Ubuntu 11.10:
libnss3-1d 3.14.1-0ckbi1.93ubuntu.0.11.10.1
Ubuntu 10.04 LTS:
libnss3-1d 3.14.1-0ckbi1.93ubuntu.0.10.04.1
After a standard system update you need to restart any applications that
use NSS, such as Evolution and Chromium, to make all the necessary
changes.
References:
http://www.ubuntu.com/usn/usn-1687-1
CVE-2013-0743
Package Information:
https://launchpad.net/ubuntu/+source/nss/3.14.1-0ckbi1.93ubuntu.0.12.10.1
https://launchpad.net/ubuntu/+source/nss/3.14.1-0ckbi1.93ubuntu.0.12.04.1
https://launchpad.net/ubuntu/+source/nss/3.14.1-0ckbi1.93ubuntu.0.11.10.1
https://launchpad.net/ubuntu/+source/nss/3.14.1-0ckbi1.93ubuntu.0.10.04.1