Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : openssl vulnerability (USN-1898-1)

Low Nessus Plugin ID 67189


The remote Ubuntu host is missing one or more security-related patches.


The TLS protocol 1.2 and earlier can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext content by observing length differences during a series of guesses in which a provided string potentially matches an unknown string in encrypted and compressed traffic. This is known as a CRIME attack in HTTP. Other protocols layered on top of TLS may also make these attacks practical.

This update disables compression for all programs using SSL and TLS provided by the OpenSSL library. To re-enable compression for programs that need compression to communicate with legacy services, define the variable OPENSSL_DEFAULT_ZLIB in the program's environment.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


Update the affected libssl0.9.8 and / or libssl1.0.0 packages.

Plugin Details

Severity: Low

ID: 67189

File Name: ubuntu_USN-1898-1.nasl

Version: $Revision: 1.3 $

Type: local

Agent: unix

Published: 2013/07/05

Modified: 2016/05/25

Dependencies: 12634

Risk Information

Risk Factor: Low


Base Score: 2.6

Temporal Score: 2.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:canonical:ubuntu_linux:libssl0.9.8, p-cpe:/a:canonical:ubuntu_linux:libssl1.0.0, cpe:/o:canonical:ubuntu_linux:10.04:-:lts, cpe:/o:canonical:ubuntu_linux:12.04:-:lts, cpe:/o:canonical:ubuntu_linux:12.10, cpe:/o:canonical:ubuntu_linux:13.04

Required KB Items: Host/cpu, Host/Ubuntu, Host/Ubuntu/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2013/07/03

Reference Information

CVE: CVE-2012-4929

BID: 55704

USN: 1898-1