Ubuntu Security Notice (C) 2013-2015 Canonical, Inc. / NASL script (C) 2013-2015 Tenable Network Security, Inc.
The remote Ubuntu host is missing a security-related patch.
USN-1732-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2013-0169
and CVE-2012-2686 was reverted in USN-1732-2 because of a regression.
This update restores the security fix, and includes an extra fix from
upstream to address the AES-NI regression. We apologize for the
Adam Langley and Wolfgang Ettlingers discovered that OpenSSL
incorrectly handled certain crafted CBC data when used with AES-NI. A
remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 12.10. (CVE-2012-2686)
Nadhem Alfardan and Kenny Paterson discovered that the TLS
protocol as used in OpenSSL was vulnerable to a timing
side-channel attack known as the 'Lucky Thirteen' issue. A
remote attacker could use this issue to perform
plaintext-recovery attacks via analysis of timing data.
Update the affected libssl1.0.0 package.
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.3
Public Exploit Available : false
Family: Ubuntu Local Security Checks
Nessus Plugin ID: 65684 ()
Bugtraq ID: 57778
CVE ID: CVE-2012-2686CVE-2013-0169
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.