USN-339-1: OpenSSL vulnerability

05 September 2006

OpenSSL vulnerability



Philip Mackenzie, Marius Schilder, Jason Waddle and Ben Laurie of
Google Security discovered that the OpenSSL library did not
sufficiently check the padding of PKCS #1 v1.5 signatures if the
exponent of the public key is 3 (which is widely used for CAs). This
could be exploited to forge signatures without the need of the secret

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 6.06
  • libssl0.9.8 - 0.9.8a-7ubuntu0.1
Ubuntu 5.10
  • libssl0.9.7 - 0.9.7g-1ubuntu1.2
Ubuntu 5.04
  • libssl0.9.7 - 0.9.7e-3ubuntu0.3

After a standard system upgrade you need to reboot your computer to
effect the necessary changes.