Login
Newsletter
Werbung

Sicherheit: Preisgabe von Informationen in OpenSSL
Aktuelle Meldungen Distributionen
Name: Preisgabe von Informationen in OpenSSL
ID: USN-1898-1
Distribution: Ubuntu
Plattformen: Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10, Ubuntu 13.04
Datum: Do, 4. Juli 2013, 08:43
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4929
Applikationen: OpenSSL

Originalnachricht


--===============3868263904762532703==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature";
boundary="RnlQjJ0d97Da+TV1"
Content-Disposition: inline


--RnlQjJ0d97Da+TV1
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-1898-1
July 04, 2013

openssl vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS

Summary:

Applications could be made to expose sensitive information over the
network.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

The TLS protocol 1.2 and earlier can encrypt compressed data without
properly obfuscating the length of the unencrypted data, which allows
man-in-the-middle attackers to obtain plaintext content by observing
length differences during a series of guesses in which a provided string
potentially matches an unknown string in encrypted and compressed traffic.
This is known as a CRIME attack in HTTP. Other protocols layered on top of
TLS may also make these attacks practical.

This update disables compression for all programs using SSL and TLS
provided by the OpenSSL library. To re-enable compression for programs
that need compression to communicate with legacy services, define the
variable OPENSSL_DEFAULT_ZLIB in the program's environment.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.04:
libssl1.0.0 1.0.1c-4ubuntu8.1

Ubuntu 12.10:
libssl1.0.0 1.0.1c-3ubuntu2.5

Ubuntu 12.04 LTS:
libssl1.0.0 1.0.1-4ubuntu5.10

Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.15

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-1898-1
CVE-2012-4929

Package Information:
https://launchpad.net/ubuntu/+source/openssl/1.0.1c-4ubuntu8.1
https://launchpad.net/ubuntu/+source/openssl/1.0.1c-3ubuntu2.5
https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.10
https://launchpad.net/ubuntu/+source/openssl/0.9.8k-7ubuntu8.15


--RnlQjJ0d97Da+TV1
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQEcBAEBAgAGBQJR1NQ6AAoJEPMhclmdjS6X5mMH/RVE78xugGt3DwXvImpq0ZT/
8647lN15f6h7L1ujc6Nr0gKKDs26lt5VrRGrMhjunL6WYkMhCzcUh1G3uYkV91HB
wvtpEXXTiC0Lvvnqurcv8ZkVzO6BCmlPMbwmzvTlnC18hleweZ8QyaDeFx1lVvgl
jGS7QYgXlXSkatM8cl4R7/kgXo61plvv6Os/BNsQS4pDgvCAQo/IlOIrXUNc1eSf
kx+7cbBMbSS1pz3kT+Nowj8Z9ulXxTAIckTaY7XggQDX0q5b92YrT2Ixcy5FdVU4
IxuFkePq2hKwkdnUSYgCXtMWl2EHc6RWx9Z5wXVZoGLZMlzcs1ChNtgffjxMbEw=
=UWUk
-----END PGP SIGNATURE-----

--RnlQjJ0d97Da+TV1--


--===============3868263904762532703==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============3868263904762532703==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung