Ubuntu users are being urged to update their operating systems to address a handful of recently patched OpenSSL vulnerabilities which affect Ubuntu and its derivatives.
Developers with Canonical, the company that oversees the Linux distribution, announced the updates on Tuesday, encouraging users to install the latest OpenSSL package versions depending on which distribution they’re running.
The updates resolve several of the vulnerabilities fixed by the cryptographic library OpenSSL last Thursday.
Three of the vulnerabilities fixed were branded “medium” severity by OpenSSL’s maintainers as they could lead to several outcomes, including a timing attack, a denial of service attack, and help an attacker potentially recover private keys.
One issue (CVE-2016-7056) was tied to the fact that OpenSSL didn’t properly use constant-time operations when it performed Elliptic Curve DSA (ECDSA) with a Curve P-256 signing. Because of this, at least on Ubuntu 12.04 LTS and Ubuntu 14.04, an attacker could have performed a timing attack to recover private keys.
OpenSSL maintainers said last week when it pushed the updates that achieving such an attack would be difficult, however.
“Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely,” OpenSSL said, “The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients.
It was discovered that the library also mishandled select truncated packets, something that could have been exploited to cause a denial of service condition. It also incorrectly performed something called the x86_64 Montgomery squaring procedure, a component that also could have been taken advantage to steal private keys. The issue only affects systems based on x86_64 architecture, like Ubuntu 16.04 LTS, and Ubuntu 16.10, however.
The rest of the fixes were relatively small potatoes and all marked “low” severity.
Another separate, less pressing issue (CVE-2016-7055) also affected how OpenSSL handles Montgomery multiplication and could lead to what Ubuntu calls “transient failures.”
The update also fixes an issue in which OpenSSL used “undefined behavior when performing pointer arithmetic,” and another in which it incorrect handled certain warning alerts. A remote attacker could exploit both vulnerabilities and cause a denial of service, according to Ubuntu’s advisory.
Ubuntu 16.10, Ubuntu, 16.04 LTS, Ubuntu 14.04, LTS Ubuntu, 12.04 LTS are all considered vulnerable under updated, the advisory warns.
The OpenSSL patches came just days after news surfaced that despite being patched three years ago, almost 200,000 servers and devices are still vulnerable to Heartbleed. The numbers came via analysis gathered by the search engine Shodan, a service that searches open ports for vulnerabilities.
According to the report roughly 52,000 Apache HTTPD servers remain vulnerable, in addition to 6,380 Amazon Web Services devices, and 4,330 Verizon Wireless devices.
The encryption library is used in a slew of devices and software; it’s up to each vendor when it wants to patch vulnerabilities however.
Cisco issued a security advisory around the vulnerabilities on Monday as many of its products incorporate OpenSSL packages. The company is unclear exactly which software is affected by the vulnerabilities but says its conducting an investigation into nearly 200 different products to determine whether they’re affected.
