USN-835-1: neon vulnerabilities

Releases

• Ubuntu 9.04
• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 6.06

Packages

• neon -
• neon27 -

Details

Joe Orton discovered that neon did not correctly handle SSL certificates
with zero bytes in the Common Name. A remote attacker could exploit this
to perform a machine-in-the-middle attack to view sensitive information or
alter encrypted communications.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.04

• libneon27 - 0.28.2-6.1ubuntu0.1
• libneon27-gnutls - 0.28.2-6.1ubuntu0.1

Ubuntu 8.10

• libneon27 - 0.28.2-2ubuntu0.1
• libneon27-gnutls - 0.28.2-2ubuntu0.1

Ubuntu 8.04

• libneon27 - 0.27.2-1ubuntu0.1
• libneon27-gnutls - 0.27.2-1ubuntu0.1

Ubuntu 6.06

• libneon25 - 0.25.5.dfsg-5ubuntu0.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2008-3746
• CVE-2009-2474