exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Ubuntu Security Notice USN-3198-1

Ubuntu Security Notice USN-3198-1
Posted Feb 16, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3198-1 - Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES ciphers were vulnerable to birthday attacks. A remote attacker could possibly use this flaw to obtain clear text data from long encrypted sessions. This update moves those algorithms to the legacy algorithm set and causes them to be used only if no non-legacy algorithms can be negotiated. It was discovered that OpenJDK accepted ECSDA signatures using non-canonical DER encoding. An attacker could use this to modify or expose sensitive data. Various other issues were also addressed.

tags | advisory, remote
systems | linux, ubuntu
advisories | CVE-2016-2183, CVE-2016-5546, CVE-2016-5548, CVE-2016-5552, CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253, CVE-2017-3261, CVE-2017-3272
SHA-256 | 401231d16faaf570a0694163991be2f69899e60a6316f4ea5ccc0ea0741ef00f

Ubuntu Security Notice USN-3198-1

Change Mirror Download

==========================================================================
Ubuntu Security Notice USN-3198-1
February 16, 2017

openjdk-6 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in OpenJDK 6.

Software Description:
- openjdk-6: Open Source Java implementation

Details:

Karthik Bhargavan and Gaetan Leurent discovered that the DES and
Triple DES ciphers were vulnerable to birthday attacks. A remote
attacker could possibly use this flaw to obtain clear text data from
long encrypted sessions. This update moves those algorithms to the
legacy algorithm set and causes them to be used only if no non-legacy
algorithms can be negotiated. (CVE-2016-2183)

It was discovered that OpenJDK accepted ECSDA signatures using
non-canonical DER encoding. An attacker could use this to modify or
expose sensitive data. (CVE-2016-5546)

It was discovered that covert timing channel vulnerabilities existed
in the DSA implementations in OpenJDK. A remote attacker could use
this to expose sensitive information. (CVE-2016-5548)

It was discovered that the URLStreamHandler class in OpenJDK did not
properly parse user information from a URL. A remote attacker could
use this to expose sensitive information. (CVE-2016-5552)

It was discovered that the URLClassLoader class in OpenJDK did not
properly check access control context when downloading class files. A
remote attacker could use this to expose sensitive information.
(CVE-2017-3231)

It was discovered that the Remote Method Invocation (RMI)
implementation in OpenJDK performed deserialization of untrusted
inputs. A remote attacker could use this to execute arbitrary
code. (CVE-2017-3241)

It was discovered that the Java Authentication and Authorization
Service (JAAS) component of OpenJDK did not properly perform user
search LDAP queries. An attacker could use a specially constructed
LDAP entry to expose or modify sensitive information. (CVE-2017-3252)

It was discovered that the PNGImageReader class in OpenJDK did not
properly handle iTXt and zTXt chunks. An attacker could use this to
cause a denial of service (memory consumption). (CVE-2017-3253)

It was discovered that integer overflows existed in the
SocketInputStream and SocketOutputStream classes of OpenJDK. An
attacker could use this to expose sensitive information.
(CVE-2017-3261)

It was discovered that the atomic field updaters in the
java.util.concurrent.atomic package in OpenJDK did not properly
restrict access to protected field members. An attacker could use
this to specially craft a Java application or applet that could bypass
Java sandbox restrictions. (CVE-2017-3272)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
icedtea-6-jre-cacao 6b41-1.13.13-0ubuntu0.12.04.1
icedtea-6-jre-jamvm 6b41-1.13.13-0ubuntu0.12.04.1
openjdk-6-jdk 6b41-1.13.13-0ubuntu0.12.04.1
openjdk-6-jre 6b41-1.13.13-0ubuntu0.12.04.1
openjdk-6-jre-headless 6b41-1.13.13-0ubuntu0.12.04.1
openjdk-6-jre-lib 6b41-1.13.13-0ubuntu0.12.04.1
openjdk-6-jre-zero 6b41-1.13.13-0ubuntu0.12.04.1

This update uses a new upstream release, which includes additional
bug fixes. After a standard system update you need to restart any
Java applications or applets to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-3198-1
CVE-2016-2183, CVE-2016-5546, CVE-2016-5548, CVE-2016-5552,
CVE-2017-3231, CVE-2017-3241, CVE-2017-3252, CVE-2017-3253,
CVE-2017-3261, CVE-2017-3272

Package Information:
https://launchpad.net/ubuntu/+source/openjdk-6/6b41-1.13.13-0ubuntu0.12.04.1


--+ts6NCQ4mrNQIV8p

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJYpRNYAAoJEC8Jno0AXoH051gQAKcJwtbXW+zIn9zL/9WdNhto
fkuRotbbHFGV9W8YmRWqobMUuNsQA1NkQJYyY+fz/JZkDc7SIzJIzI6QYwBMtbw9
Wv03SOlEP/o1mjafZPXCV+ZJtmLX83VSTllVgJqpW7cA60L3/oQ57VA0jSp56zVZ
rJK/wGJ24zQjPhfUS0QLfR7J3feSHvyKF8ULCh/s7qU2XyMj+mPSBdBoa38oRmpu
SLEL1LAQYY7CRobOOk9VWe6VtLFJYfyx044WcR7QnQEKq/zhnzpqrftnJ1VBy5iW
hduybqkVqrYtbsQHssYDryjTtFpdIIlMiMo2CBDP1jR8fIP2+f7yZGGaeNyEccf6
4FkC3tp2EWEQ9KploqkWx4ZuBmzB1F+x/JJx4pIjNNejKwe/RHD82D2LXO4UfNfm
F/H0Ze3+YDI06LW4ga9AHoOxPZ7NyhNuhlzPTR57km8htk8H/qMskgRmVojsLGgs
UvNN+6Zjwhu01tTJwaTWagTJ+CnIvS5klMv0IOgwL7aajFYebMmjGJNnJ07C9xPt
kizjvgP8yyAtllebKmFrcIoV4oB7mdoDoOot3JMJdhBFTZeQ1gA8MiA392yOx7q3
sYJePUtJ5Dt95r47IFHuunj3NNaS9d7ggtz/Czq9fTL62C4meNxCZ4MmJcB0vIUx
qadfX66g0inoqn/AdzXR
=jOUK
-----END PGP SIGNATURE-----

--+ts6NCQ4mrNQIV8p--


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close