Ubuntu Security Notice (C) 2013-2016 Canonical, Inc. / NASL script (C) 2013-2016 Tenable Network Security, Inc.
The remote Ubuntu host is missing a security-related patch.
USN-1732-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2013-0169
and CVE-2012-2686 was reverted in USN-1732-2 because of a regression.
This update restores the security fix, and includes an extra fix from
upstream to address the AES-NI regression. We apologize for the
Adam Langley and Wolfgang Ettlingers discovered that OpenSSL
incorrectly handled certain crafted CBC data when used with AES-NI. A
remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 12.10. (CVE-2012-2686)
Nadhem Alfardan and Kenny Paterson discovered that the TLS
protocol as used in OpenSSL was vulnerable to a timing
side-channel attack known as the 'Lucky Thirteen' issue. A
remote attacker could use this issue to perform
plaintext-recovery attacks via analysis of timing data.
Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.
Update the affected libssl1.0.0 package.
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.3
Public Exploit Available : false