Executive Summary

Summary
Title OpenSSL vulnerability
Informations
Name USN-990-1 First vendor Publication 2010-09-21
Vendor Ubuntu Last vendor Modification 2010-09-21
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Cvss Base Score 5.8 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 9.04 Ubuntu 9.10 Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 6.06 LTS:
libssl0.9.8 0.9.8a-7ubuntu0.12

Ubuntu 8.04 LTS:
libssl0.9.8 0.9.8g-4ubuntu3.10

Ubuntu 9.04:
libssl0.9.8 0.9.8g-15ubuntu3.5

Ubuntu 9.10:
libssl0.9.8 0.9.8g-16ubuntu3.2

Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.1

After a standard system update you need to reboot your computer to make all the necessary changes.

Details follow:

Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user's session. This update adds backported support for the new RFC5746 renegotiation extension and will use it when both the client and the server support it.

ATTENTION: After applying this update, a patched server will allow both patched and unpatched clients to connect, but unpatched clients will not be able to renegotiate. For more information, please refer to the following: http://www.openssl.org/docs/ssl/SSL_CTX_set_options.html#SECURE_RENEGOTIATION

Original Source

Url : http://www.ubuntu.com/usn/USN-990-1

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2016-04-27 00:37:49
  • Multiple Updates
2014-02-17 12:07:05
  • Multiple Updates