Ubuntu 12.04 LTS / 12.10 : openssl regression (USN-1732-2)

Ubuntu Security Notice (C) 2013 Canonical, Inc. / NASL script (C) 2013-2014 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related patches.

Description :

USN-1732-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2013-0166
and CVE-2012-2686 introduced a regression causing decryption failures
on hardware supporting AES-NI. This update temporarily reverts the
security fix pending further investigation. We apologize for the
inconvenience.

Adam Langley and Wolfgang Ettlingers discovered that OpenSSL
incorrectly handled certain crafted CBC data when used with AES-NI. A
remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 12.10. (CVE-2012-2686)

Nadhem Alfardan and Kenny Paterson discovered that the TLS
protocol as used in OpenSSL was vulnerable to a timing
side-channel attack known as the 'Lucky Thirteen' issue. A
remote attacker could use this issue to perform
plaintext-recovery attacks via analysis of timing data.
(CVE-2013-0169).

Solution :

Update the affected libssl1.0.0 and / or openssl packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS Temporal Score : 4.3
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 64968 ()

Bugtraq ID: 57755
57778

CVE ID: CVE-2012-2686
CVE-2013-0166
CVE-2013-0169