USN-522-1: openssl vulnerabilities

Packages

openssl -

Details

It was discovered that OpenSSL did not correctly perform Montgomery
multiplications. Local attackers might be able to reconstruct RSA
private keys by examining another user’s OpenSSL processes. (CVE-2007-3108)

Moritz Jodeit discovered that OpenSSL’s SSL_get_shared_ciphers function
did not correctly check the size of the buffer it was writing to.
A remote attacker could exploit this to write one NULL byte past the end of
an application’s cipher list buffer, possibly leading to arbitrary code
execution or a denial of service. (CVE-2007-5135)

It was discovered that OpenSSL did not correctly perform Montgomery
multiplications. Local attackers might be able to reconstruct RSA
private keys by examining another user’s OpenSSL processes. (CVE-2007-3108)

Moritz Jodeit discovered that OpenSSL’s SSL_get_shared_ciphers function
did not correctly check the size of the buffer it was writing to.
A remote attacker could exploit this to write one NULL byte past the end of
an application’s cipher list buffer, possibly leading to arbitrary code
execution or a denial of service. (CVE-2007-5135)

Update instructions

After a standard system upgrade you need to reboot your computer to effect the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
7.04 feisty	libssl0.9.8 – 0.9.8c-4ubuntu0.1
6.10 edgy	libssl0.9.8 – 0.9.8b-2ubuntu2.1
6.06 dapper	libssl0.9.8 – 0.9.8a-7ubuntu0.4

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References