ESB-2017.1868 - [Ubuntu] nss: Multiple vulnerabilities 2017-08-01

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.1868
                       USN-3372-1: NSS vulnerability
                               1 August 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           nss
Publisher:         Ubuntu
Operating System:  Ubuntu
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Access Privileged Data          -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
                   Provide Misleading Information  -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-7502 CVE-2017-5461 CVE-2016-2183

Reference:         ASB-2017.0102
                   ASB-2017.0074
                   ASB-2017.0065
                   ESB-2016.2263
                   ESB-2016.2239.2
                   ESB-2016.2238

Original Bulletin: 
   http://www.ubuntu.com/usn/usn-3372-1

- --------------------------BEGIN INCLUDED TEXT--------------------

USN-3372-1: NSS vulnerability

Ubuntu Security Notice USN-3372-1

31st July, 2017

nss vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

    Ubuntu 12.04 LTS

Summary

Several security issues were fixed in NSS.

Software description

    nss - Network Security Service library

Details

It was discovered that NSS incorrectly handled certain empty SSLv2
messages. A remote attacker could possibly use this issue to cause NSS to
crash, resulting in a denial of service. (CVE-2017-7502)

Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES
ciphers were vulnerable to birthday attacks. A remote attacker could
possibly use this flaw to obtain clear text data from long encrypted
sessions. This update causes NSS to limit use of the same symmetric key.
(CVE-2016-2183)

It was discovered that NSS incorrectly handled Base64 decoding. A remote
attacker could use this flaw to cause NSS to crash, resulting in a denial
of service, or possibly execute arbitrary code. (CVE-2017-5461)
Update instructions

The problem can be corrected by updating your system to the following package 
version:

Ubuntu 12.04 LTS:
    libnss3 2:3.28.4-0ubuntu0.12.04.1 

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use NSS, such as Evolution and Chromium, to make all the necessary
changes.
References

CVE-2016-2183, CVE-2017-5461, CVE-2017-7502

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWX/YT4x+lLeg9Ub1AQgIWxAAiYM8LBxicdQOwjDaoQ7Fwn11D5DDaT+x
2Hi28Ui0lwgOhPKj4El0e6VBMv4+mb8MfAKEIJgFZQ1ZElLVLAafdyd9YoENuBaE
RgKYmfiXKPxTo3O8u0tQEacSaW237+CyI2RY/ti1/vlBfowqqMeMJx9kTgCRUSaP
i53t8aBI4+qMFiuOM36m8IsUrsBL2kvE1LdDsvdvIMv1W44EjTQlSJT7JzKSkf2a
/zYe9b6MyFoAXWPOzm3f0plo9nRrVKn5x9hYgGEgmENWwkQPxHpJw6VNQp/UE0Fe
xJejHhLC3xx1pasaciSvaaJzTvYuefAqBM35+sisGUpHhvFYjcCC3raaM/lWWMSO
tNk5/0stpT919jQXbQhZfIEtqsKWTPOwUfNV8qUYO5HxF3c2uQ1D84kkBvTwEI9f
TS5s8GzAYJSeJ1J7H4DRjMY6/cQ67XxuXbEmri0pdq+Bk1uU2Kaad5YMn3BmTdyF
35G9jJNhIPlvIP9Ms0E40EJPRzMlhxqVzDM977eUFgFF6eKs/UMKbOS3gr9mOima
XSyJvFf0YNCXALmUsl6yRjdCIBIMk81vRIHNap0QdZmD4nwY79UgFk4Fsd2ukMdY
68b89gSJbL+/hhqP7Dj9fiW/F1CDckaFRkE3pE0IM6/fiwrwVe1Yzlk3gw09D7Iy
e4wFB625CRM=
=YaZB
-----END PGP SIGNATURE-----

« Back to bulletins