1. Ubuntu Security Notices
  2. USN-1898-1

USN-1898-1: OpenSSL vulnerability

Publication date

4 July 2013

Overview

Applications could be made to expose sensitive information over the network.

Releases

Packages

  • openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details

The TLS protocol 1.2 and earlier can encrypt compressed data without
properly obfuscating the length of the unencrypted data, which allows
machine-in-the-middle attackers to obtain plaintext content by observing
length differences during a series of guesses in which a provided string
potentially matches an unknown string in encrypted and compressed traffic.
This is known as a CRIME attack in HTTP. Other protocols layered on top of
TLS may also make these attacks practical.

This update disables compression for all programs using SSL and TLS
provided by the OpenSSL library. To re-enable compression for programs
that need compression to communicate with legacy services, define the
variable OPENSSL_DEFAULT_ZLIB in the program’s environment.

The TLS protocol 1.2 and earlier can encrypt compressed data without
properly obfuscating the length of the unencrypted data, which allows
machine-in-the-middle attackers to obtain plaintext content by observing
length differences during a series of guesses in which a provided string
potentially matches an unknown string in encrypted and compressed traffic.
This is known as a CRIME attack in HTTP. Other protocols layered on top of
TLS may also make these attacks practical.

This update disables compression for all programs using SSL and TLS
provided by the OpenSSL library. To re-enable compression for programs
that need compression to communicate with legacy services, define the
variable OPENSSL_DEFAULT_ZLIB in the program’s environment.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
13.04 raring libssl1.0.0 –  1.0.1c-4ubuntu8.1
12.10 quantal libssl1.0.0 –  1.0.1c-3ubuntu2.5
12.04 precise libssl1.0.0 –  1.0.1-4ubuntu5.10
10.04 lucid libssl0.9.8 –  0.9.8k-7ubuntu8.15

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›