1. Ubuntu Security Notices
  2. USN-353-2

USN-353-2: OpenSSL vulnerability

Publication date

5 October 2006

Overview

OpenSSL vulnerability

Releases

Details

USN-353-1 fixed several vulnerabilities in OpenSSL. However, Mark J
Cox noticed that the applied patch for CVE-2006-2940 was flawed. This
update corrects that patch.

For reference, this is the relevant part of the original advisory:

Certain types of public key could take disproportionate amounts of
time to process. The library now limits the maximum key exponent
size to avoid Denial of Service attacks. (CVE-2006-2940)

USN-353-1 fixed several vulnerabilities in OpenSSL. However, Mark J
Cox noticed that the applied patch for CVE-2006-2940 was flawed. This
update corrects that patch.

For reference, this is the relevant part of the original advisory:

Certain types of public key could take disproportionate amounts of
time to process. The library now limits the maximum key exponent
size to avoid Denial of Service attacks. (CVE-2006-2940)

Update instructions

After a standard system upgrade you need to reboot your computer to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
6.06 dapper libssl0.9.8 –  0.9.8a-7ubuntu0.3
5.10 breezy libssl0.9.7 –  0.9.7g-1ubuntu1.5
5.04 hoary libssl0.9.7 –  0.9.7e-3ubuntu0.6

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›