USN-3571-1

Dashboard / Vulnerabilities / USN-3571-1

USN-3571-1

Summary: erlang vulnerabilities

Details: It was discovered that the Erlang FTP module incorrectly handled certain CRLF sequences. A remote attacker could possibly use this issue to inject arbitrary FTP commands. This issue only affected Ubuntu 14.04 LTS. (CVE-2014-1693) It was discovered that Erlang incorrectly checked CBC padding bytes. A remote attacker could possibly use this issue to perform a padding oracle attack and decrypt traffic. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-2774) It was discovered that Erlang incorrectly handled certain regular expressions. A remote attacker could possibly use this issue to cause Erlang to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10253) Hanno Böck, Juraj Somorovsky and Craig Young discovered that the Erlang otp TLS server incorrectly handled error reporting. A remote attacker could possibly use this issue to perform a variation of the Bleichenbacher attack and decrypt traffic or sign messages. (CVE-2017-1000385)

References: https://ubuntu.com/security/notices/USN-3571-1, https://ubuntu.com/security/CVE-2014-1693, https://ubuntu.com/security/CVE-2015-2774, https://ubuntu.com/security/CVE-2016-10253, https://ubuntu.com/security/CVE-2017-1000385