Executive Summary

Summary
Title OpenSSL vulnerabilities
Informations
NameUSN-2914-1First vendor Publication2016-03-01
VendorUbuntuLast vendor Modification2016-03-01
Severity (Vendor) N/ARevisionN/A

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score10Attack RangeNetwork
Cvss Impact Score10Attack ComplexityLow
Cvss Expoit Score10AuthenticationNone Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 15.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS

Summary:

Several security issues were fixed in OpenSSL.

Software Description: - openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Yuval Yarom, Daniel Genkin, and Nadia Heninger discovered that OpenSSL was vulnerable to a side-channel attack on modular exponentiation. On certain CPUs, a local attacker could possibly use this issue to recover RSA keys. This flaw is known as CacheBleed. (CVE-2016-0702)

Adam Langley discovered that OpenSSL incorrectly handled memory when parsing DSA private keys. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-0705)

Guido Vranken discovered that OpenSSL incorrectly handled hex digit calculation in the BN_hex2bn function. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-0797)

Emilia Käsper discovered that OpenSSL incorrectly handled memory when performing SRP user database lookups. A remote attacker could possibly use this issue to cause OpenSSL to consume memory, resulting in a denial of service. (CVE-2016-0798)

Guido Vranken discovered that OpenSSL incorrectly handled memory when printing very long strings. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-0799)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.10:
libssl1.0.0 1.0.2d-0ubuntu1.4

Ubuntu 14.04 LTS:
libssl1.0.0 1.0.1f-1ubuntu2.18

Ubuntu 12.04 LTS:
libssl1.0.0 1.0.1-4ubuntu5.35

After a standard system update you need to reboot your computer to make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2914-1
CVE-2016-0702, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798,
CVE-2016-0799

Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.2d-0ubuntu1.4
https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.18
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.35

Original Source

Url : http://www.ubuntu.com/usn/USN-2914-1

CWE : Common Weakness Enumeration

%idName
33 %CWE-399Resource Management Errors
33 %CWE-200Information Exposure
33 %CWE-119Failure to Constrain Operations within the Bounds of a Memory Buffer

CPE : Common Platform Enumeration

TypeDescriptionCount
Application32
Application45
Application2
Application1
Os3
Os2
Os22

Nessus® Vulnerability Scanner

DateDescription
2018-10-18Name : The remote host is missing a macOS update that fixes multiple security vulner...
File : macos_10_14.nasl - Type : ACT_GATHER_INFO
2017-05-09Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-560.nasl - Type : ACT_GATHER_INFO
2017-05-09Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-561.nasl - Type : ACT_GATHER_INFO
2017-03-02Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL40524634.nasl - Type : ACT_GATHER_INFO
2017-01-05Name : The remote device is missing a vendor-supplied security patch.
File : juniper_jsa10759.nasl - Type : ACT_GATHER_INFO
2016-11-17Name : An IDE application installed on the remote macOS or Mac OS X host is affected...
File : macosx_xcode_81.nasl - Type : ACT_GATHER_INFO
2016-11-10Name : The remote host is affected by multiple vulnerabilities.
File : screenos_JSA10759.nasl - Type : ACT_GATHER_INFO
2016-10-18Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-2073.nasl - Type : ACT_GATHER_INFO
2016-09-28Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0135.nasl - Type : ACT_GATHER_INFO
2016-08-30Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL52349521.nasl - Type : ACT_GATHER_INFO
2016-08-30Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL79215841.nasl - Type : ACT_GATHER_INFO
2016-08-12Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_7b1a4a27600a11e6a6c314dae9d210b8.nasl - Type : ACT_GATHER_INFO
2016-08-04Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL22334603.nasl - Type : ACT_GATHER_INFO
2016-07-25Name : An application installed on the remote host is affected by multiple vulnerabi...
File : oracle_secure_global_desktop_jul_2016_cpu.nasl - Type : ACT_GATHER_INFO
2016-07-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-e1234b65a2.nasl - Type : ACT_GATHER_INFO
2016-07-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-1aaf308de4.nasl - Type : ACT_GATHER_INFO
2016-07-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-7c48036d73.nasl - Type : ACT_GATHER_INFO
2016-07-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-c558e58b21.nasl - Type : ACT_GATHER_INFO
2016-06-23Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0086.nasl - Type : ACT_GATHER_INFO
2016-06-22Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-3576.nasl - Type : ACT_GATHER_INFO
2016-06-22Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0071.nasl - Type : ACT_GATHER_INFO
2016-06-15Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-715.nasl - Type : ACT_GATHER_INFO
2016-06-09Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160510_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2016-05-20Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-607.nasl - Type : ACT_GATHER_INFO
2016-05-20Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-1360-1.nasl - Type : ACT_GATHER_INFO
2016-05-19Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-701.nasl - Type : ACT_GATHER_INFO
2016-05-18Name : The remote web server is affected by multiple vulnerabilities.
File : hpsmh_7_5_5.nasl - Type : ACT_GATHER_INFO
2016-05-17Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-0996.nasl - Type : ACT_GATHER_INFO
2016-05-16Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-0996.nasl - Type : ACT_GATHER_INFO
2016-05-16Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0049.nasl - Type : ACT_GATHER_INFO
2016-05-16Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-1290-1.nasl - Type : ACT_GATHER_INFO
2016-05-12Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-563.nasl - Type : ACT_GATHER_INFO
2016-05-12Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-575.nasl - Type : ACT_GATHER_INFO
2016-05-11Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-0722.nasl - Type : ACT_GATHER_INFO
2016-05-11Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-0722.nasl - Type : ACT_GATHER_INFO
2016-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0722.nasl - Type : ACT_GATHER_INFO
2016-05-11Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0996.nasl - Type : ACT_GATHER_INFO
2016-05-11Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160509_openssl_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2016-05-11Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-1267-1.nasl - Type : ACT_GATHER_INFO
2016-05-06Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-565.nasl - Type : ACT_GATHER_INFO
2016-05-03Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_8c2b2f110ebe11e6b55eb499baebfeaf.nasl - Type : ACT_GATHER_INFO
2016-05-02Name : The remote host is missing one or more security updates.
File : mysql_5_6_30_rpm.nasl - Type : ACT_GATHER_INFO
2016-05-02Name : The remote host is missing one or more security updates.
File : mysql_5_7_12_rpm.nasl - Type : ACT_GATHER_INFO
2016-04-25Name : The remote web server is running an application that is affected by multiple ...
File : splunk_6334.nasl - Type : ACT_GATHER_INFO
2016-04-22Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_6_30.nasl - Type : ACT_GATHER_INFO
2016-04-22Name : The remote database server is affected by multiple vulnerabilities.
File : mysql_5_7_12.nasl - Type : ACT_GATHER_INFO
2016-04-13Name : The remote AIX host has a version of OpenSSL installed that is affected by mu...
File : aix_openssl_advisory18.nasl - Type : ACT_GATHER_INFO
2016-03-25Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL93122894.nasl - Type : ACT_GATHER_INFO
2016-03-21Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201603-15.nasl - Type : ACT_GATHER_INFO
2016-03-15Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_6d33b3e5ea0311e585be14dae9d210b8.nasl - Type : ACT_GATHER_INFO
2016-03-14Name : The remote Fedora host is missing a security update.
File : fedora_2016-e6807b3394.nasl - Type : ACT_GATHER_INFO
2016-03-14Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-327.nasl - Type : ACT_GATHER_INFO
2016-03-11Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2016-661.nasl - Type : ACT_GATHER_INFO
2016-03-10Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2016-0379.nasl - Type : ACT_GATHER_INFO
2016-03-08Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0678-1.nasl - Type : ACT_GATHER_INFO
2016-03-07Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0631-1.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-294.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0624-1.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0641-1.nasl - Type : ACT_GATHER_INFO
2016-03-04Name : The remote Fedora host is missing a security update.
File : fedora_2016-2802690366.nasl - Type : ACT_GATHER_INFO
2016-03-03Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2016-062-02.nasl - Type : ACT_GATHER_INFO
2016-03-03Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-288.nasl - Type : ACT_GATHER_INFO
2016-03-03Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-289.nasl - Type : ACT_GATHER_INFO
2016-03-03Name : The remote openSUSE host is missing a security update.
File : openSUSE-2016-292.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-0301.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2016-0302.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3500.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_1s.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote service is affected by multiple vulnerabilities.
File : openssl_1_0_2g.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-0301.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2016-0302.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0031.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0301.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2016-0302.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160301_openssl_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20160301_openssl_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0617-1.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-0620-1.nasl - Type : ACT_GATHER_INFO
2016-03-02Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2914-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
DateInformations
2016-03-10 05:28:33
  • Multiple Updates
2016-03-09 21:29:26
  • Multiple Updates
2016-03-07 21:28:40
  • Multiple Updates
2016-03-07 17:28:59
  • Multiple Updates
2016-03-04 01:38:25
  • Multiple Updates
2016-03-03 13:23:26
  • Multiple Updates
2016-03-01 17:27:56
  • Multiple Updates
2016-03-01 17:23:38
  • First insertion