Ubuntu 10.04 LTS / 12.04 LTS / 14.04 LTS / 14.10 : openssl vulnerabilities (USN-2537-1)

Ubuntu Security Notice (C) 2015-2016 Canonical, Inc. / NASL script (C) 2015-2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

It was discovered that OpenSSL incorrectly handled malformed EC
private key files. A remote attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service, or execute
arbitrary code. (CVE-2015-0209)

Stephen Henson discovered that OpenSSL incorrectly handled comparing
ASN.1 boolean types. A remote attacker could possibly use this issue
to cause OpenSSL to crash, resulting in a denial of service.
(CVE-2015-0286)

Emilia Kasper discovered that OpenSSL incorrectly handled ASN.1
structure reuse. A remote attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service, or execute
arbitrary code. (CVE-2015-0287)

Brian Carpenter discovered that OpenSSL incorrectly handled invalid
certificate keys. A remote attacker could possibly use this issue to
cause OpenSSL to crash, resulting in a denial of service.
(CVE-2015-0288)

Michal Zalewski discovered that OpenSSL incorrectly handled missing
outer ContentInfo when parsing PKCS#7 structures. A remote attacker
could possibly use this issue to cause OpenSSL to crash, resulting in
a denial of service, or execute arbitrary code. (CVE-2015-0289)

Robert Dugal and David Ramos discovered that OpenSSL incorrectly
handled decoding Base64 encoded data. A remote attacker could possibly
use this issue to cause OpenSSL to crash, resulting in a denial of
service, or execute arbitrary code. (CVE-2015-0292)

Sean Burford and Emilia Kasper discovered that OpenSSL incorrectly
handled specially crafted SSLv2 CLIENT-MASTER-KEY messages. A remote
attacker could possibly use this issue to cause OpenSSL to crash,
resulting in a denial of service. (CVE-2015-0293).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected libssl0.9.8 and / or libssl1.0.0 packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.5
(CVSS2#E:U/RL:OF/RC:C)
Public Exploit Available : false

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 81971 ()

Bugtraq ID: 73225
73227
73228
73231
73232
73237
73239

CVE ID: CVE-2015-0209
CVE-2015-0286
CVE-2015-0287
CVE-2015-0288
CVE-2015-0289
CVE-2015-0292
CVE-2015-0293

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now