1. Ubuntu Security Notices
  2. USN-2914-1

USN-2914-1: OpenSSL vulnerabilities

Publication date

1 March 2016

Overview

Several security issues were fixed in OpenSSL.

Releases

Packages

  • openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details

Yuval Yarom, Daniel Genkin, and Nadia Heninger discovered that OpenSSL was
vulnerable to a side-channel attack on modular exponentiation. On certain
CPUs, a local attacker could possibly use this issue to recover RSA keys.
This flaw is known as CacheBleed. (CVE-2016-0702)

Adam Langley discovered that OpenSSL incorrectly handled memory when
parsing DSA private keys. A remote attacker could use this issue to cause
OpenSSL to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-0705)

Guido Vranken discovered that OpenSSL incorrectly handled hex digit
calculation in the BN_hex2bn function. A remote attacker could use this
issue to cause OpenSSL to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2016-0797)

Emilia Käsper discovered that OpenSSL...

Yuval Yarom, Daniel Genkin, and Nadia Heninger discovered that OpenSSL was
vulnerable to a side-channel attack on modular exponentiation. On certain
CPUs, a local attacker could possibly use this issue to recover RSA keys.
This flaw is known as CacheBleed. (CVE-2016-0702)

Adam Langley discovered that OpenSSL incorrectly handled memory when
parsing DSA private keys. A remote attacker could use this issue to cause
OpenSSL to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-0705)

Guido Vranken discovered that OpenSSL incorrectly handled hex digit
calculation in the BN_hex2bn function. A remote attacker could use this
issue to cause OpenSSL to crash, resulting in a denial of service, or
possibly execute arbitrary code. (CVE-2016-0797)

Emilia Käsper discovered that OpenSSL incorrectly handled memory when
performing SRP user database lookups. A remote attacker could possibly use
this issue to cause OpenSSL to consume memory, resulting in a denial of
service. (CVE-2016-0798)

Guido Vranken discovered that OpenSSL incorrectly handled memory when
printing very long strings. A remote attacker could use this issue to cause
OpenSSL to crash, resulting in a denial of service, or possibly execute
arbitrary code. (CVE-2016-0799)

Update instructions

After a standard system update you need to reboot your computer to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
15.10 wily libssl1.0.0 –  1.0.2d-0ubuntu1.4
14.04 trusty libssl1.0.0 –  1.0.1f-1ubuntu2.18
12.04 precise libssl1.0.0 –  1.0.1-4ubuntu5.35

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›