우분투 TLS 원격 리모트 취약점 발견 업데이트 안내

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 17.04

- Ubuntu 16.10

- Ubuntu 16.04 LTS

- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in GnuTLS.

Software Description:

- gnutls28: GNU TLS library

- gnutls26: GNU TLS library

Details:

Hubert Kario discovered that GnuTLS incorrectly handled decoding a status

response TLS extension. A remote attacker could possibly use this issue to

cause GnuTLS to crash, resulting in a denial of service. This issue only

applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-7507)

It was discovered that GnuTLS incorrectly handled decoding certain OpenPGP

certificates. A remote attacker could use this issue to cause GnuTLS to

crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2017-7869)

Update instructions:

The problem can be corrected by updating your system to the following

package versions:

Ubuntu 17.04:

  libgnutls30                     3.5.6-4ubuntu4.1

Ubuntu 16.10:

  libgnutls30                     3.5.3-5ubuntu1.2

Ubuntu 16.04 LTS:

  libgnutls30                     3.4.10-4ubuntu1.3

Ubuntu 14.04 LTS:

  libgnutls26                     2.12.23-12ubuntu2.8

In general, a standard system update will make all the necessary changes.

References:

  https://www.ubuntu.com/usn/usn-3318-1

  CVE-2017-7507, CVE-2017-7869

Package Information:

  https://launchpad.net/ubuntu/+source/gnutls28/3.5.6-4ubuntu4.1

  https://launchpad.net/ubuntu/+source/gnutls28/3.5.3-5ubuntu1.2

  https://launchpad.net/ubuntu/+source/gnutls28/3.4.10-4ubuntu1.3

  https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-12ubuntu2.8