Multiple vulnerabilities found and corrected in gnutls
Reporter | Title | Published | Views | Family All 44 |
---|---|---|---|---|
![]() | GnuTLS -- multiple vulnerabilities | 21 May 200900:00 | – | freebsd |
![]() | GLSA-200905-04 : GnuTLS: Multiple vulnerabilities | 26 May 200900:00 | – | nessus |
![]() | Mandriva Linux Security Advisory : gnutls (MDVSA-2009:116) | 19 May 200900:00 | – | nessus |
![]() | FreeBSD : GnuTLS -- multiple vulnerabilities (b31a1088-460f-11de-a11a-0022156e8794) | 20 Aug 200900:00 | – | nessus |
![]() | Slackware 12.0 / 12.1 / 12.2 / current : gnutls (SSA:2009-128-01) | 11 May 200900:00 | – | nessus |
![]() | Mandriva Linux Security Advisory : gnutls (MDVSA-2009:308) | 4 Dec 200900:00 | – | nessus |
![]() | FreeBSD Ports: gnutls | 2 Sep 200900:00 | – | openvas |
![]() | Gentoo Security Advisory GLSA 200905-04 (gnutls) | 25 May 200900:00 | – | openvas |
![]() | FreeBSD Ports: gnutls | 2 Sep 200900:00 | – | openvas |
![]() | Mandrake Security Advisory MDVSA-2009:116 (gnutls) | 5 Jun 200900:00 | – | openvas |
# OpenVAS Vulnerability Test
# $Id: mdksa_2009_116.nasl 6573 2017-07-06 13:10:50Z cfischer $
# Description: Auto-generated from advisory MDVSA-2009:116 (gnutls)
#
# Authors:
# Thomas Reinke <[email protected]>
#
# Copyright:
# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com
# Text descriptions are largely excerpted from the referenced
# advisory, and are Copyright (c) the respective author(s)
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2,
# or at your option, GNU General Public License version 3,
# as published by the Free Software Foundation
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
#
include("revisions-lib.inc");
tag_insight = "Multiple vulnerabilities has been found and corrected in gnutls:
lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not
properly handle invalid DSA signatures, which allows remote attackers
to cause a denial of service (application crash) and possibly have
unspecified other impact via a malformed DSA key that triggers a (1)
free of an uninitialized pointer or (2) double free (CVE-2009-1415).
lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates
RSA keys stored in DSA structures, instead of the intended DSA keys,
which might allow remote attackers to spoof signatures on certificates
or have unspecified other impact by leveraging an invalid DSA key
(CVE-2009-1416).
gnutls-cli in GnuTLS before 2.6.6 does not verify the activation
and expiration times of X.509 certificates, which allows remote
attackers to successfully present a certificate that is (1) not yet
valid or (2) no longer valid, related to lack of time checks in the
_gnutls_x509_verify_certificate function in lib/x509/verify.c in
libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup
(CVE-2009-1417).
The updated packages have been patched to prevent this.
Affected: 2008.1, 2009.0, 2009.1, Corporate 4.0";
tag_solution = "To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2009:116";
tag_summary = "The remote host is missing an update to gnutls
announced via advisory MDVSA-2009:116.";
if(description)
{
script_id(64129);
script_version("$Revision: 6573 $");
script_tag(name:"last_modification", value:"$Date: 2017-07-06 15:10:50 +0200 (Thu, 06 Jul 2017) $");
script_tag(name:"creation_date", value:"2009-06-05 18:04:08 +0200 (Fri, 05 Jun 2009)");
script_cve_id("CVE-2009-1415", "CVE-2009-1416", "CVE-2009-1417");
script_tag(name:"cvss_base", value:"7.5");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_name("Mandrake Security Advisory MDVSA-2009:116 (gnutls)");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com");
script_family("Mandrake Local Security Checks");
script_dependencies("gather-package-list.nasl");
script_mandatory_keys("ssh/login/mandriva_mandrake_linux", "ssh/login/rpms");
script_tag(name : "insight" , value : tag_insight);
script_tag(name : "solution" , value : tag_solution);
script_tag(name : "summary" , value : tag_summary);
script_tag(name:"qod_type", value:"package");
script_tag(name:"solution_type", value:"VendorFix");
exit(0);
}
#
# The script code starts here
#
include("pkg-lib-rpm.inc");
res = "";
report = "";
if ((res = isrpmvuln(pkg:"gnutls", rpm:"gnutls~2.3.0~2.5mdv2008.1", rls:"MNDK_2008.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls26", rpm:"libgnutls26~2.3.0~2.5mdv2008.1", rls:"MNDK_2008.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls-devel", rpm:"libgnutls-devel~2.3.0~2.5mdv2008.1", rls:"MNDK_2008.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls26", rpm:"lib64gnutls26~2.3.0~2.5mdv2008.1", rls:"MNDK_2008.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls-devel", rpm:"lib64gnutls-devel~2.3.0~2.5mdv2008.1", rls:"MNDK_2008.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"gnutls", rpm:"gnutls~2.4.1~2.4mdv2009.0", rls:"MNDK_2009.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls26", rpm:"libgnutls26~2.4.1~2.4mdv2009.0", rls:"MNDK_2009.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls-devel", rpm:"libgnutls-devel~2.4.1~2.4mdv2009.0", rls:"MNDK_2009.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls26", rpm:"lib64gnutls26~2.4.1~2.4mdv2009.0", rls:"MNDK_2009.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls-devel", rpm:"lib64gnutls-devel~2.4.1~2.4mdv2009.0", rls:"MNDK_2009.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"gnutls", rpm:"gnutls~2.6.4~1.2mdv2009.1", rls:"MNDK_2009.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls26", rpm:"libgnutls26~2.6.4~1.2mdv2009.1", rls:"MNDK_2009.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls-devel", rpm:"libgnutls-devel~2.6.4~1.2mdv2009.1", rls:"MNDK_2009.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls26", rpm:"lib64gnutls26~2.6.4~1.2mdv2009.1", rls:"MNDK_2009.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls-devel", rpm:"lib64gnutls-devel~2.6.4~1.2mdv2009.1", rls:"MNDK_2009.1")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"gnutls", rpm:"gnutls~1.0.25~2.4.20060mlcs4", rls:"MNDK_4.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls11", rpm:"libgnutls11~1.0.25~2.4.20060mlcs4", rls:"MNDK_4.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"libgnutls11-devel", rpm:"libgnutls11-devel~1.0.25~2.4.20060mlcs4", rls:"MNDK_4.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls11", rpm:"lib64gnutls11~1.0.25~2.4.20060mlcs4", rls:"MNDK_4.0")) != NULL) {
report += res;
}
if ((res = isrpmvuln(pkg:"lib64gnutls11-devel", rpm:"lib64gnutls11-devel~1.0.25~2.4.20060mlcs4", rls:"MNDK_4.0")) != NULL) {
report += res;
}
if (report != "") {
security_message(data:report);
} else if (__pkg_match) {
exit(99); # Not vulnerable.
}
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo