[USN-1064-1] OpenSSL vulnerability; [USN-1065-1] shadow vulnerability

Flubber · February 15, 2011

2 urate.

1.

===========================================================
Ubuntu Security Notice USN-1064-1 February 15, 2011
openssl vulnerability
CVE-2011-0014
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 10.04 LTS
Ubuntu 10.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 10.04 LTS:
libssl0.9.8 0.9.8k-7ubuntu8.6
Ubuntu 10.10:
libssl0.9.8 0.9.8o-1ubuntu4.4
After a standard system update you need to reboot your computer to make
all the necessary changes.
Details follow:
Neel Mehta discovered that incorrectly formatted ClientHello handshake
messages could cause OpenSSL to parse past the end of the message.
This could allow a remote attacker to cause a crash and denial of
service by triggering invalid memory accesses.

2.

===========================================================
Ubuntu Security Notice USN-1065-1 February 15, 2011
shadow vulnerability
CVE-2011-0721
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 9.10:
passwd 1:4.1.4.1-1ubuntu2.2
Ubuntu 10.04 LTS:
passwd 1:4.1.4.2-1ubuntu2.2
Ubuntu 10.10:
passwd 1:4.1.4.2-1ubuntu3.2
In general, a standard system update will make all the necessary changes.
Details follow:
Kees Cook discovered that some shadow utilities did not correctly validate
user input. A local attacker could exploit this flaw to inject newlines into
the /etc/passwd file. If the system was configured to use NIS, this could
lead to existing NIS groups or users gaining or losing access to the system,
resulting in a denial of service or unauthorized access.

Update & packet upgrade:

sudo apt-get update
sudo apt-get upgrade

sudo apt-get clean
sudo apt-get autoclean
sudo apt-get autoremove

sudo shutdown -r 0   -- restart
^ sau: sudo reboot

Primite via RSS

1] http://seclists.org/fulldisclosure/2011/Feb/313

2] http://seclists.org/fulldisclosure/2011/Feb/329