Poodle TLS1.0 issue in Trusty (and Precise)

[Bryan Quigley]

[Impact]
Gnutls is affected by the Poodle TLS exploit https://community.qualys.com/blogs/securitylabs/2014/12/08/poodle-bites-tls

[Test Case]
launch a new trusty VM
sudo apt-get install cups
Open /etc/cups/cupsd.conf and change just this one section
...
# Only listen for connections from the local machine.
#Listen localhost:631
Listen /var/run/cups/cups.sock

SSLPort 443
SSLOptions None
ServerAlias 127.35.213.162.lcy-02.canonistack.canonical.com
...
Restart cups and then run the ssllabs test - https://www.ssllabs.com/ssltest/

[Regression Potential]
This is a simple off by one error, that's fixed in all newer versions of gnutls.

[Bryan Quigley (bryanquigley)]

Tested both with ssllabs should go from F rating to C rating - POODLE TLS issue should be gone, but SSLv3 will still be enabled. That's a separate bug - 1505328.

[Bryan Quigley (bryanquigley)]

Unlike the other cups patch, this gnutls bug I believe should go to security pocket.

[Marc Deslauriers (mdeslaur)]

Hi Bryan,

Thanks for the debdiffs!

Where did you obtain the patch from Hanno Boeck from?

[Bryan Quigley (bryanquigley)]

Hi Marc,

In an private email, he did mention that he planned to blog about it in the future.

[Hanno Böck (hanno-hboeck)]

Took me a bit longer, but blogpost is now public and explains the issue in detail including its history and first incomplete fix:
https://blog.hboeck.de/archives/877-A-little-POODLE-left-in-GnuTLS-old-versions.html

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnutls26 - 2.12.23-12ubuntu2.3

---------------
gnutls26 (2.12.23-12ubuntu2.3) trusty-security; urgency=medium

  * SECURITY UPDATE: Poodle TLS issue
    - debian/patches/fix_tls_poodle.patch: fixes off by one
      issue in padding check.
      Patch created by Hanno Boeck (https://hboeck.de/)
    (LP: #1510163)

 -- Bryan Quigley <email address hidden> Wed, 25 Nov 2015 21:37:33 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnutls26 - 2.12.14-5ubuntu3.10

---------------
gnutls26 (2.12.14-5ubuntu3.10) precise-security; urgency=low

  * SECURITY UPDATE: Poodle TLS issue
    - debian/patches/fix_tls_poodle.patch: fixes off by one
      issue in padding check.
      Patch created by Hanno Boeck (https://hboeck.de/)
    (LP: #1510163)

 -- Bryan Quigley <email address hidden> Wed, 25 Nov 2015 21:37:58 +0000

[Marc Deslauriers (mdeslaur)]

Publishing as a security update now, thanks!