Ubuntu Security Notice (C) 2013 Canonical, Inc. / NASL script (C) 2013-2014 Tenable Network Security, Inc.
The remote Ubuntu host is missing one or more security-related patches.
Adam Langley and Wolfgang Ettlingers discovered that OpenSSL
incorrectly handled certain crafted CBC data when used with AES-NI. A
remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 12.10. (CVE-2012-2686)
Stephen Henson discovered that OpenSSL incorrectly performed signature
verification for OCSP responses. A remote attacker could use this
issue to cause OpenSSL to crash, resulting in a denial of service.
Nadhem Alfardan and Kenny Paterson discovered that the TLS protocol as
used in OpenSSL was vulnerable to a timing side-channel attack known
as the 'Lucky Thirteen' issue. A remote attacker could use this issue
to perform plaintext-recovery attacks via analysis of timing data.
Update the affected libssl0.9.8 and / or libssl1.0.0 packages.
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.3
Public Exploit Available : true