USN-704-1: OpenSSL vulnerability

Releases

• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 6.06

Packages

• openssl -

Details

It was discovered that OpenSSL did not properly perform signature verification
on DSA and ECDSA keys. If user or automated system connected to a malicious
server or a remote attacker were able to perform a machine-in-the-middle attack,
this flaw could be exploited to view sensitive information.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.10

• libssl0.9.8 - 0.9.8g-10.1ubuntu2.1
• openssl - 0.9.8g-10.1ubuntu2.1

Ubuntu 8.04

• libssl0.9.8 - 0.9.8g-4ubuntu3.4
• openssl - 0.9.8g-4ubuntu3.4

Ubuntu 7.10

• libssl0.9.8 - 0.9.8e-5ubuntu3.3
• openssl - 0.9.8e-5ubuntu3.3

Ubuntu 6.06

• libssl0.9.8 - 0.9.8a-7ubuntu0.6
• openssl - 0.9.8a-7ubuntu0.6

After a standard system upgrade you need to reboot your computer to
effect the necessary changes.

References

• CVE-2008-5077