USN-1898-1: OpenSSL vulnerability

4 July 2013

openssl vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 13.04
  • Ubuntu 12.10
  • Ubuntu 12.04 LTS
  • Ubuntu 10.04 LTS

Summary

Applications could be made to expose sensitive information over the network.

Software Description

  • openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details

The TLS protocol 1.2 and earlier can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext content by observing length differences during a series of guesses in which a provided string potentially matches an unknown string in encrypted and compressed traffic. This is known as a CRIME attack in HTTP. Other protocols layered on top of TLS may also make these attacks practical.

This update disables compression for all programs using SSL and TLS provided by the OpenSSL library. To re-enable compression for programs that need compression to communicate with legacy services, define the variable OPENSSL_DEFAULT_ZLIB in the program’s environment.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 13.04
libssl1.0.0 - 1.0.1c-4ubuntu8.1
Ubuntu 12.10
libssl1.0.0 - 1.0.1c-3ubuntu2.5
Ubuntu 12.04 LTS
libssl1.0.0 - 1.0.1-4ubuntu5.10
Ubuntu 10.04 LTS
libssl0.9.8 - 0.9.8k-7ubuntu8.15

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References