{"id": "RHSA-2006:0207", "hash": "e2527bc7ed99f052ed122103a8addf4e", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2006:0207) gnutls security update", "description": "The GNU TLS Library provides support for cryptographic algorithms and\r\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed for\r\nASN.1 structures management that includes DER encoding and decoding.\r\n\r\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\r\ncould create a carefully crafted invalid X.509 certificate in such a way\r\nthat could trigger this flaw if parsed by an application that uses GNU TLS.\r\nThis could lead to a denial of service (application crash). It is not\r\ncertain if this issue could be escalated to allow arbitrary code execution. \r\nThe Common Vulnerabilities and Exposures project assigned the name\r\nCVE-2006-0645 to this issue.\r\n\r\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\r\nEvolution client when connecting to an Exchange server or when publishing\r\ncalendar information to a WebDAV server.\r\n\r\nUsers are advised to upgrade to these updated packages, which contain a\r\nbackported patch from the GNU TLS maintainers to correct this issue.", "published": "2006-02-10T05:00:00", "modified": "2017-09-08T12:18:16", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2006:0207", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2006-0645"], "lastseen": "2018-12-11T17:41:51", "history": [{"bulletin": {"id": "RHSA-2006:0207", "hash": "", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2006:0207) gnutls security update", "description": "The GNU TLS Library provides support for cryptographic algorithms and\r\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed for\r\nASN.1 structures management that includes DER encoding and decoding.\r\n\r\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\r\ncould create a carefully crafted invalid X.509 certificate in such a way\r\nthat could trigger this flaw if parsed by an application that uses GNU TLS.\r\nThis could lead to a denial of service (application crash). It is not\r\ncertain if this issue could be escalated to allow arbitrary code execution. \r\nThe Common Vulnerabilities and Exposures project assigned the name\r\nCVE-2006-0645 to this issue.\r\n\r\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\r\nEvolution client when connecting to an Exchange server or when publishing\r\ncalendar information to a WebDAV server.\r\n\r\nUsers are advised to upgrade to these updated packages, which contain a\r\nbackported patch from the GNU TLS maintainers to correct this issue.", "published": "2006-02-10T05:00:00", "modified": "2015-04-24T14:19:56", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2006:0207", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2006-0645"], "lastseen": "2016-09-04T11:17:45", "history": [], "viewCount": 0, "enchantments": {}, "objectVersion": "1.4", "affectedPackage": [{"packageFilename": "gnutls-devel-1.0.20-3.2.2.ia64.rpm", "packageName": "gnutls-devel", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "ia64"}, {"packageFilename": "gnutls-1.0.20-3.2.2.s390.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "s390"}, {"packageFilename": "gnutls-1.0.20-3.2.2.x86_64.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "x86_64"}, {"packageFilename": "gnutls-1.0.20-3.2.2.ppc64.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "ppc64"}, {"packageFilename": "gnutls-1.0.20-3.2.2.ppc.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "ppc"}, {"packageFilename": "gnutls-devel-1.0.20-3.2.2.s390x.rpm", "packageName": "gnutls-devel", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "s390x"}, {"packageFilename": "gnutls-devel-1.0.20-3.2.2.ppc.rpm", "packageName": "gnutls-devel", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "ppc"}, {"packageFilename": "gnutls-devel-1.0.20-3.2.2.s390.rpm", "packageName": "gnutls-devel", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "s390"}, {"packageFilename": "gnutls-1.0.20-3.2.2.i386.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "i386"}, {"packageFilename": "gnutls-devel-1.0.20-3.2.2.x86_64.rpm", "packageName": "gnutls-devel", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "x86_64"}, {"packageFilename": "gnutls-1.0.20-3.2.2.s390x.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "s390x"}, {"packageFilename": "gnutls-1.0.20-3.2.2.ia64.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "ia64"}, {"packageFilename": "gnutls-1.0.20-3.2.2.src.rpm", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "src"}, {"packageFilename": "gnutls-devel-1.0.20-3.2.2.i386.rpm", "packageName": "gnutls-devel", "packageVersion": "1.0.20-3.2.2", "operator": "lt", "OSVersion": "any", "OS": "RedHat", "arch": "i386"}]}, "lastseen": "2016-09-04T11:17:45", "differentElements": ["affectedPackage", "modified"], "edition": 1}, {"bulletin": {"id": "RHSA-2006:0207", "hash": "", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2006:0207) gnutls security update", "description": "The GNU TLS Library provides support for cryptographic algorithms and\r\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed for\r\nASN.1 structures management that includes DER encoding and decoding.\r\n\r\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\r\ncould create a carefully crafted invalid X.509 certificate in such a way\r\nthat could trigger this flaw if parsed by an application that uses GNU TLS.\r\nThis could lead to a denial of service (application crash). It is not\r\ncertain if this issue could be escalated to allow arbitrary code execution. \r\nThe Common Vulnerabilities and Exposures project assigned the name\r\nCVE-2006-0645 to this issue.\r\n\r\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\r\nEvolution client when connecting to an Exchange server or when publishing\r\ncalendar information to a WebDAV server.\r\n\r\nUsers are advised to upgrade to these updated packages, which contain a\r\nbackported patch from the GNU TLS maintainers to correct this issue.", "published": "2006-02-10T05:00:00", "modified": "2017-07-29T20:35:11", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2006:0207", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2006-0645"], "lastseen": "2017-08-02T22:57:33", "history": [], "viewCount": 0, "enchantments": {}, "objectVersion": "1.4", "affectedPackage": [{"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.ppc.rpm", "arch": "ppc", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.ppc64.rpm", "arch": "ppc64", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls-devel", "packageFilename": "gnutls-devel-1.0.20-3.2.2.ppc.rpm", "arch": "ppc", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}]}, "lastseen": "2017-08-02T22:57:33", "differentElements": ["affectedPackage", "modified"], "edition": 2}, {"bulletin": {"id": "RHSA-2006:0207", "hash": "7ac4e3e6ca93fa395aeb3bcd02cb3869", "type": "redhat", "bulletinFamily": "unix", "title": "(RHSA-2006:0207) gnutls security update", "description": "The GNU TLS Library provides support for cryptographic algorithms and\r\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed for\r\nASN.1 structures management that includes DER encoding and decoding.\r\n\r\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\r\ncould create a carefully crafted invalid X.509 certificate in such a way\r\nthat could trigger this flaw if parsed by an application that uses GNU TLS.\r\nThis could lead to a denial of service (application crash). It is not\r\ncertain if this issue could be escalated to allow arbitrary code execution. \r\nThe Common Vulnerabilities and Exposures project assigned the name\r\nCVE-2006-0645 to this issue.\r\n\r\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\r\nEvolution client when connecting to an Exchange server or when publishing\r\ncalendar information to a WebDAV server.\r\n\r\nUsers are advised to upgrade to these updated packages, which contain a\r\nbackported patch from the GNU TLS maintainers to correct this issue.", "published": "2006-02-10T05:00:00", "modified": "2017-09-08T12:18:16", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2006:0207", "reporter": "RedHat", "references": [], "cvelist": ["CVE-2006-0645"], "lastseen": "2017-09-09T07:20:39", "history": [], "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}}, "objectVersion": "1.4", "affectedPackage": [{"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.i386.rpm", "arch": "i386", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.x86_64.rpm", "arch": "x86_64", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls-devel", "packageFilename": "gnutls-devel-1.0.20-3.2.2.x86_64.rpm", "arch": "x86_64", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.src.rpm", "arch": "src", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.ia64.rpm", "arch": "ia64", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls-devel", "packageFilename": "gnutls-devel-1.0.20-3.2.2.ia64.rpm", "arch": "ia64", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls-devel", "packageFilename": "gnutls-devel-1.0.20-3.2.2.i386.rpm", "arch": "i386", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.ppc.rpm", "arch": "ppc", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.ppc64.rpm", "arch": "ppc64", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls-devel", "packageFilename": "gnutls-devel-1.0.20-3.2.2.ppc.rpm", "arch": "ppc", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.s390.rpm", "arch": "s390", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls-devel", "packageFilename": "gnutls-devel-1.0.20-3.2.2.s390.rpm", "arch": "s390", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls", "packageFilename": "gnutls-1.0.20-3.2.2.s390x.rpm", "arch": "s390x", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}, {"packageVersion": "1.0.20-3.2.2", "packageName": "gnutls-devel", "packageFilename": "gnutls-devel-1.0.20-3.2.2.s390x.rpm", "arch": "s390x", "operator": "lt", "OSVersion": "any", "OS": "RedHat"}]}, "lastseen": "2017-09-09T07:20:39", "differentElements": ["affectedPackage"], "edition": 3}], "viewCount": 0, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-0645"]}, {"type": "gentoo", "idList": ["GLSA-200602-08"]}, {"type": "nessus", "idList": ["REDHAT-RHSA-2006-0207.NASL", "MANDRAKE_MDKSA-2006-039.NASL", "DEBIAN_DSA-986.NASL", "UBUNTU_USN-251-1.NASL", "DEBIAN_DSA-985.NASL", "FEDORA_2006-107.NASL", "GENTOO_GLSA-200602-08.NASL", "CENTOS_RHSA-2006-0207.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:56358", "OPENVAS:136141256231065506", "OPENVAS:56327", "OPENVAS:56359", "OPENVAS:65506"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:11706", "SECURITYVULNS:DOC:11705"]}, {"type": "debian", "idList": ["DEBIAN:DSA-986-1:5AF11", "DEBIAN:DSA-985-1:337E5"]}, {"type": "osvdb", "idList": ["OSVDB:23054"]}, {"type": "centos", "idList": ["CESA-2006:0207"]}, {"type": "ubuntu", "idList": ["USN-251-1"]}], "modified": "2018-12-11T17:41:51"}, "vulnersScore": 7.5}, "objectVersion": "1.4", "affectedPackage": [{"OS": "RedHat", "OSVersion": "any", "arch": "i386", "packageName": "gnutls", "packageVersion": "1.0.20-3.2.2", "packageFilename": "gnutls-1.0.20-3.2.2.i386.rpm", "operator": "lt"}], "_object_type": "robots.models.redhat.RedHatBulletin", "_object_types": ["robots.models.redhat.RedHatBulletin", "robots.models.base.Bulletin"]}

{"cve": [{"lastseen": "2018-10-20T11:06:29", "bulletinFamily": "NVD", "description": "Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via \"out-of-bounds access\" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.", "modified": "2018-10-19T11:45:41", "published": "2006-02-10T13:06:00", "id": "CVE-2006-0645", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0645", "title": "CVE-2006-0645", "type": "cve", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2019-01-16T20:06:58", "bulletinFamily": "scanner", "description": "Evgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component of the Tiny ASN.1 Library that allows attackers\nto crash the DER decoder and possibly execute arbitrary code.", "modified": "2018-07-20T00:00:00", "published": "2006-10-14T00:00:00", "id": "DEBIAN_DSA-985.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=22851", "title": "Debian DSA-985-1 : libtasn1-2 - buffer overflows", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-985. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(22851);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2018/07/20 2:17:12\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_bugtraq_id(16568);\n script_xref(name:\"DSA\", value:\"985\");\n\n script_name(english:\"Debian DSA-985-1 : libtasn1-2 - buffer overflows\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Evgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component of the Tiny ASN.1 Library that allows attackers\nto crash the DER decoder and possibly execute arbitrary code.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2006/dsa-985\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the libtasn1 packages.\n\nThe old stable distribution (woody) is not affected by these problems.\n\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2_0.2.10-3sarge1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:libtasn1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:3.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/03/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/10/14\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/02/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"3.1\", prefix:\"libtasn1-2\", reference:\"0.2.10-3sarge1\")) flag++;\nif (deb_check(release:\"3.1\", prefix:\"libtasn1-2-dev\", reference:\"0.2.10-3sarge1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:06:33", "bulletinFamily": "scanner", "description": "Evgeny Legerov discovered a buffer overflow in the DER format decoding\nfunction of the libtasn library. This library is mainly used by the\nGNU TLS library; by sending a specially crafted X.509 certificate to a\nserver which uses TLS encryption/authentication, a remote attacker\ncould exploit this to crash that server process and possibly even\nexecute arbitrary code with the privileges of that server.\n\nIn order to fix the vulnerability in libtasn, several internal\nfunction signatures had to be changed; some of these functions are\nused by the GNU TLS library, so that library needs to be updated as\nwell.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2018-08-03T00:00:00", "published": "2006-03-13T00:00:00", "id": "UBUNTU_USN-251-1.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=21060", "title": "Ubuntu 4.10 / 5.04 / 5.10 : libtasn1-2 vulnerability (USN-251-1)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-251-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(21060);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/08/03 12:21:23\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_xref(name:\"USN\", value:\"251-1\");\n\n script_name(english:\"Ubuntu 4.10 / 5.04 / 5.10 : libtasn1-2 vulnerability (USN-251-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Evgeny Legerov discovered a buffer overflow in the DER format decoding\nfunction of the libtasn library. This library is mainly used by the\nGNU TLS library; by sending a specially crafted X.509 certificate to a\nserver which uses TLS encryption/authentication, a remote attacker\ncould exploit this to crash that server process and possibly even\nexecute arbitrary code with the privileges of that server.\n\nIn order to fix the vulnerability in libtasn, several internal\nfunction signatures had to be changed; some of these functions are\nused by the GNU TLS library, so that library needs to be updated as\nwell.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:gnutls-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgnutls-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgnutls10\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgnutls10-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgnutls11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgnutls11-dbg\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libgnutls11-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libtasn1-2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libtasn1-2-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:4.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:5.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:5.10\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/02/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/03/13\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/02/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2006-2018 Canonical, Inc. / NASL script (C) 2006-2017 Tenable Network Security, Inc.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(4\\.10|5\\.04|5\\.10)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 4.10 / 5.04 / 5.10\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"4.10\", pkgname:\"gnutls-bin\", pkgver:\"1.0.4-3ubuntu1.2\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"libgnutls-doc\", pkgver:\"1.0.4-3ubuntu1.2\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"libgnutls10\", pkgver:\"1.0.4-3ubuntu1.2\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"libgnutls10-dev\", pkgver:\"1.0.4-3ubuntu1.2\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"libtasn1-2\", pkgver:\"0.2.10-4ubuntu0.0.5.04.1\")) flag++;\nif (ubuntu_check(osver:\"4.10\", pkgname:\"libtasn1-2-dev\", pkgver:\"0.2.10-4ubuntu0.0.5.04.1\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"gnutls-bin\", pkgver:\"1.0.16-13ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"libgnutls11\", pkgver:\"1.0.16-13ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"libgnutls11-dbg\", pkgver:\"1.0.16-13ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"libgnutls11-dev\", pkgver:\"1.0.16-13ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"libtasn1-2\", pkgver:\"0.2.7-2ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"5.04\", pkgname:\"libtasn1-2-dev\", pkgver:\"0.2.7-2ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"gnutls-bin\", pkgver:\"1.0.16-13.1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"libgnutls11\", pkgver:\"1.0.16-13.1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"libgnutls11-dbg\", pkgver:\"1.0.16-13.1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"libgnutls11-dev\", pkgver:\"1.0.16-13.1ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"libtasn1-2\", pkgver:\"0.2.10-4ubuntu0.1\")) flag++;\nif (ubuntu_check(osver:\"5.10\", pkgname:\"libtasn1-2-dev\", pkgver:\"0.2.10-4ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gnutls-bin / libgnutls-doc / libgnutls10 / libgnutls10-dev / etc\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:06:32", "bulletinFamily": "scanner", "description": "Evgeny Legerov discovered cases of possible out-of-bounds access in\nthe DER decoding schemes of libtasn1, when provided with invalid\ninput. This library is bundled with gnutls.\n\nThe provided packages have been patched to correct these issues.", "modified": "2018-07-19T00:00:00", "published": "2006-02-14T00:00:00", "id": "MANDRAKE_MDKSA-2006-039.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=20897", "title": "Mandrake Linux Security Advisory : gnutls (MDKSA-2006:039)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2006:039. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(20897);\n script_version (\"1.14\");\n script_cvs_date(\"Date: 2018/07/19 20:59:13\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_xref(name:\"MDKSA\", value:\"2006:039\");\n\n script_name(english:\"Mandrake Linux Security Advisory : gnutls (MDKSA-2006:039)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandrake Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Evgeny Legerov discovered cases of possible out-of-bounds access in\nthe DER decoding schemes of libtasn1, when provided with invalid\ninput. This library is bundled with gnutls.\n\nThe provided packages have been patched to correct these issues.\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gnutls11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:lib64gnutls11-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgnutls11\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libgnutls11-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2006\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:mandrakesoft:mandrake_linux:le2005\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/02/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/02/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK10.1\", reference:\"gnutls-1.0.13-1.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"x86_64\", reference:\"lib64gnutls11-1.0.13-1.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"x86_64\", reference:\"lib64gnutls11-devel-1.0.13-1.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libgnutls11-1.0.13-1.2.101mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.1\", cpu:\"i386\", reference:\"libgnutls11-devel-1.0.13-1.2.101mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK10.2\", reference:\"gnutls-1.0.23-2.2.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64gnutls11-1.0.23-2.2.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"x86_64\", reference:\"lib64gnutls11-devel-1.0.23-2.2.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libgnutls11-1.0.23-2.2.102mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK10.2\", cpu:\"i386\", reference:\"libgnutls11-devel-1.0.23-2.2.102mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK2006.0\", reference:\"gnutls-1.0.25-2.1.20060mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK2006.0\", cpu:\"x86_64\", reference:\"lib64gnutls11-1.0.25-2.1.20060mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK2006.0\", cpu:\"x86_64\", reference:\"lib64gnutls11-devel-1.0.25-2.1.20060mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK2006.0\", cpu:\"i386\", reference:\"libgnutls11-1.0.25-2.1.20060mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK2006.0\", cpu:\"i386\", reference:\"libgnutls11-devel-1.0.25-2.1.20060mdk\", yank:\"mdk\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:06:58", "bulletinFamily": "scanner", "description": "Evgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component of the Tiny ASN.1 Library, which is also\npresent and used in GnuTLS, the GNU implementation for Transport Layer\nSecurity (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols and\nwhich allows attackers to crash the DER decoder and possibly execute\narbitrary code.", "modified": "2018-07-20T00:00:00", "published": "2006-10-14T00:00:00", "id": "DEBIAN_DSA-986.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=22852", "title": "Debian DSA-986-1 : gnutls11 - buffer overflows", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-986. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(22852);\n script_version(\"1.15\");\n script_cvs_date(\"Date: 2018/07/20 2:17:12\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_bugtraq_id(16568);\n script_xref(name:\"DSA\", value:\"986\");\n\n script_name(english:\"Debian DSA-986-1 : gnutls11 - buffer overflows\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Evgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component of the Tiny ASN.1 Library, which is also\npresent and used in GnuTLS, the GNU implementation for Transport Layer\nSecurity (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols and\nwhich allows attackers to crash the DER decoder and possibly execute\narbitrary code.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2006/dsa-986\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the gnutls packages.\n\nThe old stable distribution (woody) is not affected by these problems.\n\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.0.16-13.2.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:gnutls11\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:3.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/03/06\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/10/14\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/02/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"3.1\", prefix:\"gnutls-bin\", reference:\"1.0.16-13.2\")) flag++;\nif (deb_check(release:\"3.1\", prefix:\"libgnutls11\", reference:\"1.0.16-13.2\")) flag++;\nif (deb_check(release:\"3.1\", prefix:\"libgnutls11-dbg\", reference:\"1.0.16-13.2\")) flag++;\nif (deb_check(release:\"3.1\", prefix:\"libgnutls11-dev\", reference:\"1.0.16-13.2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:06:32", "bulletinFamily": "scanner", "description": "Updated gnutls packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe GNU TLS Library provides support for cryptographic algorithms and\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed\nfor ASN.1 structures management that includes DER encoding and\ndecoding.\n\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\ncould create a carefully crafted invalid X.509 certificate in such a\nway that could trigger this flaw if parsed by an application that uses\nGNU TLS. This could lead to a denial of service (application crash).\nIt is not certain if this issue could be escalated to allow arbitrary\ncode execution. The Common Vulnerabilities and Exposures project\nassigned the name CVE-2006-0645 to this issue.\n\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\nEvolution client when connecting to an Exchange server or when\npublishing calendar information to a WebDAV server.\n\nUsers are advised to upgrade to these updated packages, which contain\na backported patch from the GNU TLS maintainers to correct this issue.", "modified": "2018-11-16T00:00:00", "published": "2006-02-11T00:00:00", "id": "REDHAT-RHSA-2006-0207.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=20886", "title": "RHEL 4 : gnutls (RHSA-2006:0207)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2006:0207. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(20886);\n script_version (\"1.20\");\n script_cvs_date(\"Date: 2018/11/16 15:19:25\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_xref(name:\"RHSA\", value:\"2006:0207\");\n\n script_name(english:\"RHEL 4 : gnutls (RHSA-2006:0207)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated gnutls packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe GNU TLS Library provides support for cryptographic algorithms and\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed\nfor ASN.1 structures management that includes DER encoding and\ndecoding.\n\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\ncould create a carefully crafted invalid X.509 certificate in such a\nway that could trigger this flaw if parsed by an application that uses\nGNU TLS. This could lead to a denial of service (application crash).\nIt is not certain if this issue could be escalated to allow arbitrary\ncode execution. The Common Vulnerabilities and Exposures project\nassigned the name CVE-2006-0645 to this issue.\n\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\nEvolution client when connecting to an Exchange server or when\npublishing calendar information to a WebDAV server.\n\nUsers are advised to upgrade to these updated packages, which contain\na backported patch from the GNU TLS maintainers to correct this issue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2006-0645\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2006:0207\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected gnutls and / or gnutls-devel packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:gnutls-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/02/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 4.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2006:0207\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL4\", reference:\"gnutls-1.0.20-3.2.2\")) flag++;\n if (rpm_check(release:\"RHEL4\", reference:\"gnutls-devel-1.0.20-3.2.2\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gnutls / gnutls-devel\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:06:32", "bulletinFamily": "scanner", "description": "- Fri Feb 10 2006 Martin Stransky <stransky at redhat.com>\n 1.0.25-2.FC4\n\n - fix for CVE-2006-0645\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "modified": "2018-07-19T00:00:00", "published": "2006-02-11T00:00:00", "id": "FEDORA_2006-107.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=20884", "title": "Fedora Core 4 : gnutls-1.0.25-2.FC4 (2006-107)", "type": "nessus", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2006-107.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(20884);\n script_version (\"1.12\");\n script_cvs_date(\"Date: 2018/07/19 23:19:05\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_xref(name:\"FEDORA\", value:\"2006-107\");\n\n script_name(english:\"Fedora Core 4 : gnutls-1.0.25-2.FC4 (2006-107)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora Core host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Fri Feb 10 2006 Martin Stransky <stransky at redhat.com>\n 1.0.25-2.FC4\n\n - fix for CVE-2006-0645\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/announce/2006-February/001817.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?74c6b47a\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected gnutls, gnutls-debuginfo and / or gnutls-devel\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gnutls-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:gnutls-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora_core:4\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/02/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/02/11\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^4([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 4.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC4\", reference:\"gnutls-1.0.25-2.FC4\")) flag++;\nif (rpm_check(release:\"FC4\", reference:\"gnutls-debuginfo-1.0.25-2.FC4\")) flag++;\nif (rpm_check(release:\"FC4\", reference:\"gnutls-devel-1.0.25-2.FC4\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"gnutls / gnutls-debuginfo / gnutls-devel\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:06:43", "bulletinFamily": "scanner", "description": "Updated gnutls packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe GNU TLS Library provides support for cryptographic algorithms and\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed\nfor ASN.1 structures management that includes DER encoding and\ndecoding.\n\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\ncould create a carefully crafted invalid X.509 certificate in such a\nway that could trigger this flaw if parsed by an application that uses\nGNU TLS. This could lead to a denial of service (application crash).\nIt is not certain if this issue could be escalated to allow arbitrary\ncode execution. The Common Vulnerabilities and Exposures project\nassigned the name CVE-2006-0645 to this issue.\n\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\nEvolution client when connecting to an Exchange server or when\npublishing calendar information to a WebDAV server.\n\nUsers are advised to upgrade to these updated packages, which contain\na backported patch from the GNU TLS maintainers to correct this issue.", "modified": "2018-11-10T00:00:00", "published": "2006-07-05T00:00:00", "id": "CENTOS_RHSA-2006-0207.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=21987", "title": "CentOS 4 : gnutls (CESA-2006:0207)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2006:0207 and \n# CentOS Errata and Security Advisory 2006:0207 respectively.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(21987);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/11/10 11:49:27\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_xref(name:\"RHSA\", value:\"2006:0207\");\n\n script_name(english:\"CentOS 4 : gnutls (CESA-2006:0207)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated gnutls packages that fix a security issue are now available\nfor Red Hat Enterprise Linux 4.\n\nThis update has been rated as having important security impact by the\nRed Hat Security Response Team.\n\nThe GNU TLS Library provides support for cryptographic algorithms and\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed\nfor ASN.1 structures management that includes DER encoding and\ndecoding.\n\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\ncould create a carefully crafted invalid X.509 certificate in such a\nway that could trigger this flaw if parsed by an application that uses\nGNU TLS. This could lead to a denial of service (application crash).\nIt is not certain if this issue could be escalated to allow arbitrary\ncode execution. The Common Vulnerabilities and Exposures project\nassigned the name CVE-2006-0645 to this issue.\n\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\nEvolution client when connecting to an Exchange server or when\npublishing calendar information to a WebDAV server.\n\nUsers are advised to upgrade to these updated packages, which contain\na backported patch from the GNU TLS maintainers to correct this issue.\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2006-February/012632.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e6ae2d4c\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2006-February/012635.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f26d2688\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2006-February/012636.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?dd8fe9bf\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected gnutls packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:gnutls-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:4\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/02/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/07/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/CentOS/release\")) audit(AUDIT_OS_NOT, \"CentOS\");\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-4\", reference:\"gnutls-1.0.20-3.2.2\")) flag++;\nif (rpm_check(release:\"CentOS-4\", reference:\"gnutls-devel-1.0.20-3.2.2\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-01-16T20:06:32", "bulletinFamily": "scanner", "description": "The remote host is affected by the vulnerability described in GLSA-200602-08\n(libtasn1, GNU TLS: Security flaw in DER decoding)\n\n Evgeny Legerov has reported a flaw in the DER decoding routines\n provided by libtasn1, which could cause an out of bounds access to\n occur.\nImpact :\n\n A remote attacker could cause an application using libtasn1 to\n crash and potentially execute arbitrary code by sending specially\n crafted input.\nWorkaround :\n\n There is no known workaround at this time.", "modified": "2018-07-11T00:00:00", "published": "2006-02-17T00:00:00", "id": "GENTOO_GLSA-200602-08.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=20934", "title": "GLSA-200602-08 : libtasn1, GNU TLS: Security flaw in DER decoding", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200602-08.\n#\n# The advisory text is Copyright (C) 2001-2017 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(20934);\n script_version(\"1.14\");\n script_cvs_date(\"Date: 2018/07/11 17:09:25\");\n\n script_cve_id(\"CVE-2006-0645\");\n script_xref(name:\"GLSA\", value:\"200602-08\");\n\n script_name(english:\"GLSA-200602-08 : libtasn1, GNU TLS: Security flaw in DER decoding\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200602-08\n(libtasn1, GNU TLS: Security flaw in DER decoding)\n\n Evgeny Legerov has reported a flaw in the DER decoding routines\n provided by libtasn1, which could cause an out of bounds access to\n occur.\n \nImpact :\n\n A remote attacker could cause an application using libtasn1 to\n crash and potentially execute arbitrary code by sending specially\n crafted input.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200602-08\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All libtasn1 users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-libs/libtasn1-0.2.18'\n All GNU TLS users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-libs/gnutls-1.2.10'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:gnutls\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:libtasn1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2006/02/16\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2006/02/17\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2006/02/09\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2006-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"dev-libs/libtasn1\", unaffected:make_list(\"ge 0.2.18\"), vulnerable:make_list(\"lt 0.2.18\"))) flag++;\nif (qpkg_check(package:\"net-libs/gnutls\", unaffected:make_list(\"ge 1.2.10\"), vulnerable:make_list(\"lt 1.2.10\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libtasn1 / GNU TLS\");\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "openvas": [{"lastseen": "2017-07-24T12:50:25", "bulletinFamily": "scanner", "description": "The remote host is missing an update to libtasn1-2\nannounced via advisory DSA 985-1.\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component component of the Tiny ASN.1 Library that allows\nattackers to crash the DER decoder and possibly execute arbitrary code.\n\nThe old stable distribution (woody) is not affected by these problems.", "modified": "2017-07-07T00:00:00", "published": "2008-01-17T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=56358", "id": "OPENVAS:56358", "title": "Debian Security Advisory DSA 985-1 (libtasn1-2)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_985_1.nasl 6616 2017-07-07 12:10:49Z cfischer $\n# Description: Auto-generated from advisory DSA 985-1\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largerly excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_solution = \"For the stable distribution (sarge) these problems have been fixed in\nversion 2_0.2.10-3sarge1.\n\nFor the unstable distribution (sid) these problems will be fixed soon.\n\nWe recommend that you upgrade your gnutls packages.\n\n https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20985-1\";\ntag_summary = \"The remote host is missing an update to libtasn1-2\nannounced via advisory DSA 985-1.\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component component of the Tiny ASN.1 Library that allows\nattackers to crash the DER decoder and possibly execute arbitrary code.\n\nThe old stable distribution (woody) is not affected by these problems.\";\n\n\nif(description)\n{\n script_id(56358);\n script_version(\"$Revision: 6616 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:10:49 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-01-17 23:07:13 +0100 (Thu, 17 Jan 2008)\");\n script_cve_id(\"CVE-2006-0645\");\n script_bugtraq_id(16568);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Debian Security Advisory DSA 985-1 (libtasn1-2)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"libtasn1-2\", ver:\"0.2.10-3sarge1\", rls:\"DEB3.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libtasn1-2-dev\", ver:\"0.2.10-3sarge1\", rls:\"DEB3.1\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:50:22", "bulletinFamily": "scanner", "description": "The remote host is missing an update to gnutls11\nannounced via advisory DSA 986-1.\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component component of the Tiny ASN.1 Library, which is\nalso present and used in GnuTLS, the GNU implementation for Transport\nLayer Security (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols\nand which allows attackers to crash the DER decoder and possibly\nexecute arbitrary code.\n\nThe old stable distribution (woody) is not affected by these problems.", "modified": "2017-07-07T00:00:00", "published": "2008-01-17T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=56359", "id": "OPENVAS:56359", "title": "Debian Security Advisory DSA 986-1 (gnutls11)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_986_1.nasl 6616 2017-07-07 12:10:49Z cfischer $\n# Description: Auto-generated from advisory DSA 986-1\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largerly excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_solution = \"For the stable distribution (sarge) these problems have been fixed in\nversion 1.0.16-13.2.\n\nFor the unstable distribution (sid) these problems will be fixed soon.\n\nWe recommend that you upgrade your gnutls packages.\n\n https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20986-1\";\ntag_summary = \"The remote host is missing an update to gnutls11\nannounced via advisory DSA 986-1.\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component component of the Tiny ASN.1 Library, which is\nalso present and used in GnuTLS, the GNU implementation for Transport\nLayer Security (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols\nand which allows attackers to crash the DER decoder and possibly\nexecute arbitrary code.\n\nThe old stable distribution (woody) is not affected by these problems.\";\n\n\nif(description)\n{\n script_id(56359);\n script_version(\"$Revision: 6616 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:10:49 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-01-17 23:07:13 +0100 (Thu, 17 Jan 2008)\");\n script_cve_id(\"CVE-2006-0645\");\n script_bugtraq_id(16568);\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Debian Security Advisory DSA 986-1 (gnutls11)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"gnutls-bin\", ver:\"1.0.16-13.2\", rls:\"DEB3.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgnutls11\", ver:\"1.0.16-13.2\", rls:\"DEB3.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgnutls11-dbg\", ver:\"1.0.16-13.2\", rls:\"DEB3.1\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libgnutls11-dev\", ver:\"1.0.16-13.2\", rls:\"DEB3.1\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-26T08:55:30", "bulletinFamily": "scanner", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n gnutls-devel\n gnutls\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5016462 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "modified": "2017-07-11T00:00:00", "published": "2009-10-10T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=65506", "id": "OPENVAS:65506", "title": "SLES9: Security update for gnutls", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5016462.nasl 6666 2017-07-11 13:13:36Z cfischer $\n# Description: Security update for gnutls\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n gnutls-devel\n gnutls\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5016462 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_id(65506);\n script_version(\"$Revision: 6666 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-11 15:13:36 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2006-0645\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"SLES9: Security update for gnutls\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"gnutls-devel\", rpm:\"gnutls-devel~1.0.8~26.7\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:50:00", "bulletinFamily": "scanner", "description": "The remote host is missing updates announced in\nadvisory GLSA 200602-08.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=56327", "id": "OPENVAS:56327", "title": "Gentoo Security Advisory GLSA 200602-08 (libtasn1)", "type": "openvas", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A flaw in the parsing of Distinguished Encoding Rules (DER) has been\ndiscovered in libtasn1, potentially resulting in the execution of\narbitrary code.\";\ntag_solution = \"All libtasn1 users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=dev-libs/libtasn1-0.2.18'\n\nAll GNU TLS users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-libs/gnutls-1.2.10'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200602-08\nhttp://bugs.gentoo.org/show_bug.cgi?id=122307\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200602-08.\";\n\n \n\nif(description)\n{\n script_id(56327);\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_bugtraq_id(16568);\n script_cve_id(\"CVE-2006-0645\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"Gentoo Security Advisory GLSA 200602-08 (libtasn1)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"dev-libs/libtasn1\", unaffected: make_list(\"ge 0.2.18\"), vulnerable: make_list(\"lt 0.2.18\"))) != NULL) {\n report += res;\n}\nif ((res = ispkgvuln(pkg:\"net-libs/gnutls\", unaffected: make_list(\"ge 1.2.10\"), vulnerable: make_list(\"lt 1.2.10\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:38:08", "bulletinFamily": "scanner", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n gnutls-devel\n gnutls\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5016462 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "modified": "2018-04-06T00:00:00", "published": "2009-10-10T00:00:00", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065506", "id": "OPENVAS:136141256231065506", "type": "openvas", "title": "SLES9: Security update for gnutls", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5016462.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Security update for gnutls\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n gnutls-devel\n gnutls\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5016462 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.65506\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2006-0645\");\n script_tag(name:\"cvss_base\", value:\"7.5\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_name(\"SLES9: Security update for gnutls\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"gnutls-devel\", rpm:\"gnutls-devel~1.0.8~26.7\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:49", "bulletinFamily": "unix", "description": "### Background\n\nLibtasn1 is a library used to parse ASN.1 (Abstract Syntax Notation One) objects, and perform DER (Distinguished Encoding Rules) decoding. Libtasn1 is included with the GNU TLS library, which is used by applications to provide a cryptographically secure communications channel. \n\n### Description\n\nEvgeny Legerov has reported a flaw in the DER decoding routines provided by libtasn1, which could cause an out of bounds access to occur. \n\n### Impact\n\nA remote attacker could cause an application using libtasn1 to crash and potentially execute arbitrary code by sending specially crafted input. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll libtasn1 users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-libs/libtasn1-0.2.18\"\n\nAll GNU TLS users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-libs/gnutls-1.2.10\"", "modified": "2006-02-16T00:00:00", "published": "2006-02-16T00:00:00", "id": "GLSA-200602-08", "href": "https://security.gentoo.org/glsa/200602-08", "type": "gentoo", "title": "libtasn1, GNU TLS: Security flaw in DER decoding", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "debian": [{"lastseen": "2018-10-16T22:14:08", "bulletinFamily": "unix", "description": "- --------------------------------------------------------------------------\nDebian Security Advisory DSA 986-1 security@debian.org\nhttp://www.debian.org/security/ Martin Schulze\nMarch 6th, 2006 http://www.debian.org/security/faq\n- --------------------------------------------------------------------------\n\nPackage : gnutls11\nVulnerability : buffer overflows\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2006-0645\nBugTraq ID : 16568\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component component of the Tiny ASN.1 Library, which is\nalso present and used in GnuTLS, the GNU implementation for Transport\nLayer Security (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols\nand which allows attackers to crash the DER decoder and possibly\nexecute arbitrary code.\n\nThe old stable distribution (woody) is not affected by these problems.\n\nFor the stable distribution (sarge) these problems have been fixed in\nversion 1.0.16-13.2.\n\nFor the unstable distribution (sid) these problems will be fixed soon.\n\nWe recommend that you upgrade your gnutls packages.\n\n\nUpgrade Instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 3.1 alias sarge\n- --------------------------------\n\n Source archives:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls11_1.0.16-13.2.dsc\n Size/MD5 checksum: 808 91ea272dfcabd3f45115bf7ad0f523ce\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls11_1.0.16-13.2.diff.gz\n Size/MD5 checksum: 344912 b61dc44fbafa50b3f029fdca6a9b0171\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls11_1.0.16.orig.tar.gz\n Size/MD5 checksum: 1504638 7b410fa3c563c7988e434a8c8671b3cd\n\n Alpha architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_alpha.deb\n Size/MD5 checksum: 229524 023094719cc7cc7af78e58db8b5b00fc\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_alpha.deb\n Size/MD5 checksum: 334846 58f40a79fae9f6187bf409fdb293d71b\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_alpha.deb\n Size/MD5 checksum: 589302 981ec6d1b4dbac9530d980f345d6b8a3\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_alpha.deb\n Size/MD5 checksum: 511860 38a13066813dfdc2650a92a94af53c2c\n\n AMD64 architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_amd64.deb\n Size/MD5 checksum: 217226 b0a952890d682f992494ff2c725aa612\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_amd64.deb\n Size/MD5 checksum: 326678 520d37b9c1dbc74fd40f6415f83ba5a4\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_amd64.deb\n Size/MD5 checksum: 575248 3544f4d71c83823a68f260333520e1c2\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_amd64.deb\n Size/MD5 checksum: 392050 f9fdb9a9b34802ebc525cd8dd66a654d\n\n ARM architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_arm.deb\n Size/MD5 checksum: 204570 4988dbeb98ee45783d377a1de93ccb57\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_arm.deb\n Size/MD5 checksum: 294470 a64225c3dbbecd3425d27875b4972e3d\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_arm.deb\n Size/MD5 checksum: 584678 20ea03e048a696167364c1704dce96f1\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_arm.deb\n Size/MD5 checksum: 399698 f89edec95a8ddb7cd57057bb56fc711b\n\n Intel IA-32 architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_i386.deb\n Size/MD5 checksum: 206424 f39aa60ab1594acc0f895f56ee7c7b80\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_i386.deb\n Size/MD5 checksum: 301476 26736c6a911a9335c262528147d22136\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_i386.deb\n Size/MD5 checksum: 558064 ff40aa17b629c25c5f0233cf290eed1f\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_i386.deb\n Size/MD5 checksum: 370026 a13fb7ffe4180ff8ee98a3e3b0721a98\n\n Intel IA-64 architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_ia64.deb\n Size/MD5 checksum: 258704 74fca644d9a033b03fce2d9a4894c0da\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_ia64.deb\n Size/MD5 checksum: 384616 09e1ce2025cf5f5895905edd8d6a51c0\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_ia64.deb\n Size/MD5 checksum: 585584 53e4002a0df89b66771753616cf363db\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_ia64.deb\n Size/MD5 checksum: 521586 98508a5cdfb40353ff957e5f08373db1\n\n HP Precision architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_hppa.deb\n Size/MD5 checksum: 217252 1a50d1a91ef5636cbda13ec4e0f265db\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_hppa.deb\n Size/MD5 checksum: 329160 0c48e5ed532768d3d1ebef32af602c4b\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_hppa.deb\n Size/MD5 checksum: 584686 ed50b1512e730a3fa6ab426001b5bf67\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_hppa.deb\n Size/MD5 checksum: 434434 5f62fa99548ea47b551cfe49922ca234\n\n Motorola 680x0 architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_m68k.deb\n Size/MD5 checksum: 198536 3728fd475a5436e9e37477bd288efd69\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_m68k.deb\n Size/MD5 checksum: 282770 2a471ea90fc07ea10add0d7e30ba0e1e\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_m68k.deb\n Size/MD5 checksum: 560654 dd08dc4c636497eb267c22c841751140\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_m68k.deb\n Size/MD5 checksum: 341384 e583af47cd49c87c903f976d155fbf5f\n\n Big endian MIPS architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_mips.deb\n Size/MD5 checksum: 211392 4a592d84dcbb4f9fed9743207843e711\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_mips.deb\n Size/MD5 checksum: 291372 811c0397f139dad929b3ab400d5928a7\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_mips.deb\n Size/MD5 checksum: 595286 d47c254b672f89115aeafe0006a32498\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_mips.deb\n Size/MD5 checksum: 408190 3474ca5c4ea309ee40b94128b300310c\n\n Little endian MIPS architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_mipsel.deb\n Size/MD5 checksum: 211150 4716bf7c71eb01cc0c975bebcafa8371\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_mipsel.deb\n Size/MD5 checksum: 290080 1eef0b45a0292bbbbfd31d3afca3a1ef\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_mipsel.deb\n Size/MD5 checksum: 590988 e92df52cb9ddb88278e0cc5cd60f2e70\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_mipsel.deb\n Size/MD5 checksum: 404250 1c1891c93947f3b7bef2749cf17e3169\n\n PowerPC architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_powerpc.deb\n Size/MD5 checksum: 218138 96738b5cbe1756d7ef3d268f42ab021c\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_powerpc.deb\n Size/MD5 checksum: 299210 6103eb0e32b42fa04e6519aba514a5cc\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_powerpc.deb\n Size/MD5 checksum: 1415824 a314ee54d3c1f2a13b77b641d7d4a24d\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_powerpc.deb\n Size/MD5 checksum: 388604 7ad9f4b250b75798adf5c03bee72af44\n\n IBM S/390 architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_s390.deb\n Size/MD5 checksum: 215102 284d41a20d5c7ca8728c0d25aa447da4\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_s390.deb\n Size/MD5 checksum: 318308 02063f5177860d5d3ba2e52b95244f89\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_s390.deb\n Size/MD5 checksum: 631902 7e63d2fea78676ad888314faced0095e\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_s390.deb\n Size/MD5 checksum: 376224 23cef6964011ac02666c83232d30dd40\n\n Sun Sparc architecture:\n\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_sparc.deb\n Size/MD5 checksum: 204224 b4cf1c065ad8aa91ebb47dfd1995417c\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_sparc.deb\n Size/MD5 checksum: 295430 b62735044b2d0190f2096edccac74be6\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_sparc.deb\n Size/MD5 checksum: 577102 1d72152342adc1d83b8d3aac39146cca\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_sparc.deb\n Size/MD5 checksum: 399578 b23ff44d73bb2a534d9ab748518c9e23\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show &lt;pkg&gt;&#x27; and http://packages.debian.org/&lt;pkg&gt;\n\n", "modified": "2006-03-06T00:00:00", "published": "2006-03-06T00:00:00", "id": "DEBIAN:DSA-986-1:5AF11", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2006/msg00064.html", "title": "[SECURITY] [DSA 986-1] New gnutls11 packages fix arbitrary code execution", "type": "debian", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-10-16T22:14:36", "bulletinFamily": "unix", "description": "- --------------------------------------------------------------------------\nDebian Security Advisory DSA 985-1 security@debian.org\nhttp://www.debian.org/security/ Martin Schulze\nMarch 6th, 2006 http://www.debian.org/security/faq\n- --------------------------------------------------------------------------\n\nPackage : libtasn1-2\nVulnerability : buffer overflows\nProblem type : remote\nDebian-specific: no\nCVE ID : CVE-2006-0645\nBugtraq ID : 16568\n\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\nDER decoding component component of the Tiny ASN.1 Library that allows\nattackers to crash the DER decoder and possibly execute arbitrary code.\n\nThe old stable distribution (woody) is not affected by these problems.\n\nFor the stable distribution (sarge) these problems have been fixed in\nversion 2_0.2.10-3sarge1.\n\nFor the unstable distribution (sid) these problems will be fixed soon.\n\nWe recommend that you upgrade your gnutls packages.\n\n\nUpgrade Instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 3.1 alias sarge\n- --------------------------------\n\n Source archives:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1.dsc\n Size/MD5 checksum: 670 8666643f13c1feb86814483c36dcb86a\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1.diff.gz\n Size/MD5 checksum: 292137 8c9367bd26e7e6b33feb560212229ae8\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10.orig.tar.gz\n Size/MD5 checksum: 113412 ae95aa75e5db7dc4d85b2837017364a6\n\n Alpha architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_alpha.deb\n Size/MD5 checksum: 49644 4ef2707cde095b82c58b00bae5ec01cd\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_alpha.deb\n Size/MD5 checksum: 198922 1f8a6071d61e39d69b0ca0c143d83165\n\n AMD64 architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_amd64.deb\n Size/MD5 checksum: 44460 804a5db0d0ccfd0c45ee1daf66fb8d2b\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_amd64.deb\n Size/MD5 checksum: 185776 88ba0556bfbe66bb9857d8d990a16973\n\n ARM architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_arm.deb\n Size/MD5 checksum: 40998 80441d397c5610068d763528d1fa0b85\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_arm.deb\n Size/MD5 checksum: 186062 8c061b9a10eb79e975e6ba86652c47fb\n\n Intel IA-32 architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_i386.deb\n Size/MD5 checksum: 43460 5948585c89f733b64223d5cda0e9b0b3\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_i386.deb\n Size/MD5 checksum: 182750 0070e40570d4b57dcbd696a8bca3ef32\n\n Intel IA-64 architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_ia64.deb\n Size/MD5 checksum: 59434 c354bb099c7a7ff0b83b4ce4b201f134\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_ia64.deb\n Size/MD5 checksum: 200622 360eef8f745b5e20dced7eb2f9b7b283\n\n HP Precision architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_hppa.deb\n Size/MD5 checksum: 47664 0ef077cc156e5590e44a26ec85c99a49\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_hppa.deb\n Size/MD5 checksum: 187158 4f446f584c50416f5a94c2765eca734e\n\n Motorola 680x0 architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_m68k.deb\n Size/MD5 checksum: 39532 9c954f1aa9cc9ca6be038cba975547f6\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_m68k.deb\n Size/MD5 checksum: 178254 d2654672c4e00ff79f300240c0863511\n\n Big endian MIPS architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_mips.deb\n Size/MD5 checksum: 47068 a62291b5f623efeb663ba8d74768184f\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_mips.deb\n Size/MD5 checksum: 187780 7d619e82628bd9a0511eb604e258a7cc\n\n Little endian MIPS architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_mipsel.deb\n Size/MD5 checksum: 47106 66f753671aa3f743d3b28a53ac9c65b7\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_mipsel.deb\n Size/MD5 checksum: 187744 8abeac81b2d6101e8ec322ef43a7a42a\n\n PowerPC architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_powerpc.deb\n Size/MD5 checksum: 43042 9cb6b6c8282f2b5771cd6bdceab35767\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_powerpc.deb\n Size/MD5 checksum: 187828 54b7db1b1c0f64f846229d58855b723b\n\n IBM S/390 architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_s390.deb\n Size/MD5 checksum: 45394 918971380ceb9ff90d76b9961cc8498f\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_s390.deb\n Size/MD5 checksum: 185462 2e79e42a24786d899a7500d1626fe164\n\n Sun Sparc architecture:\n\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_sparc.deb\n Size/MD5 checksum: 41776 73e43f3d0917933529c3688b67b08957\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_sparc.deb\n Size/MD5 checksum: 183816 bef29056f86d10dac454d0bedd6f52cb\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show &lt;pkg&gt;&#x27; and http://packages.debian.org/&lt;pkg&gt;\n\n", "modified": "2006-03-06T00:00:00", "published": "2006-03-06T00:00:00", "id": "DEBIAN:DSA-985-1:337E5", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2006/msg00063.html", "title": "[SECURITY] [DSA 985-1] New libtasn1-2 packages fix arbitrary code execution", "type": "debian", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:16", "bulletinFamily": "software", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- --------------------------------------------------------------------------\r\nDebian Security Advisory DSA 986-1 security@debian.org\r\nhttp://www.debian.org/security/ Martin Schulze\r\nMarch 6th, 2006 http://www.debian.org/security/faq\r\n- --------------------------------------------------------------------------\r\n\r\nPackage : gnutls11\r\nVulnerability : buffer overflows\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2006-0645\r\nBugTraq ID : 16568\r\n\r\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\r\nDER decoding component component of the Tiny ASN.1 Library, which is\r\nalso present and used in GnuTLS, the GNU implementation for Transport\r\nLayer Security &#40;TLS&#41; 1.0 and Secure Sockets Layer &#40;SSL&#41; 3.0 protocols\r\nand which allows attackers to crash the DER decoder and possibly\r\nexecute arbitrary code.\r\n\r\nThe old stable distribution &#40;woody&#41; is not affected by these problems.\r\n\r\nFor the stable distribution &#40;sarge&#41; these problems have been fixed in\r\nversion 1.0.16-13.2.\r\n\r\nFor the unstable distribution &#40;sid&#41; these problems will be fixed soon.\r\n\r\nWe recommend that you upgrade your gnutls packages.\r\n\r\n\r\nUpgrade Instructions\r\n- --------------------\r\n\r\nwget url\r\n will fetch the file for you\r\ndpkg -i file.deb\r\n will install the referenced file.\r\n\r\nIf you are using the apt-get package manager, use the line for\r\nsources.list as given below:\r\n\r\napt-get update\r\n will update the internal database\r\napt-get upgrade\r\n will install corrected packages\r\n\r\nYou may use an automated update by adding the resources from the\r\nfooter to the proper configuration.\r\n\r\n\r\nDebian GNU/Linux 3.1 alias sarge\r\n- --------------------------------\r\n\r\n Source archives:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls11_1.0.16-13.2.dsc\r\n Size/MD5 checksum: 808 91ea272dfcabd3f45115bf7ad0f523ce\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls11_1.0.16-13.2.diff.gz\r\n Size/MD5 checksum: 344912 b61dc44fbafa50b3f029fdca6a9b0171\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls11_1.0.16.orig.tar.gz\r\n Size/MD5 checksum: 1504638 7b410fa3c563c7988e434a8c8671b3cd\r\n\r\n Alpha architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_alpha.deb\r\n Size/MD5 checksum: 229524 023094719cc7cc7af78e58db8b5b00fc\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_alpha.deb\r\n Size/MD5 checksum: 334846 58f40a79fae9f6187bf409fdb293d71b\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_alpha.deb\r\n Size/MD5 checksum: 589302 981ec6d1b4dbac9530d980f345d6b8a3\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_alpha.deb\r\n Size/MD5 checksum: 511860 38a13066813dfdc2650a92a94af53c2c\r\n\r\n AMD64 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_amd64.deb\r\n Size/MD5 checksum: 217226 b0a952890d682f992494ff2c725aa612\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_amd64.deb\r\n Size/MD5 checksum: 326678 520d37b9c1dbc74fd40f6415f83ba5a4\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_amd64.deb\r\n Size/MD5 checksum: 575248 3544f4d71c83823a68f260333520e1c2\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_amd64.deb\r\n Size/MD5 checksum: 392050 f9fdb9a9b34802ebc525cd8dd66a654d\r\n\r\n ARM architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_arm.deb\r\n Size/MD5 checksum: 204570 4988dbeb98ee45783d377a1de93ccb57\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_arm.deb\r\n Size/MD5 checksum: 294470 a64225c3dbbecd3425d27875b4972e3d\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_arm.deb\r\n Size/MD5 checksum: 584678 20ea03e048a696167364c1704dce96f1\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_arm.deb\r\n Size/MD5 checksum: 399698 f89edec95a8ddb7cd57057bb56fc711b\r\n\r\n Intel IA-32 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_i386.deb\r\n Size/MD5 checksum: 206424 f39aa60ab1594acc0f895f56ee7c7b80\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_i386.deb\r\n Size/MD5 checksum: 301476 26736c6a911a9335c262528147d22136\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_i386.deb\r\n Size/MD5 checksum: 558064 ff40aa17b629c25c5f0233cf290eed1f\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_i386.deb\r\n Size/MD5 checksum: 370026 a13fb7ffe4180ff8ee98a3e3b0721a98\r\n\r\n Intel IA-64 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_ia64.deb\r\n Size/MD5 checksum: 258704 74fca644d9a033b03fce2d9a4894c0da\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_ia64.deb\r\n Size/MD5 checksum: 384616 09e1ce2025cf5f5895905edd8d6a51c0\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_ia64.deb\r\n Size/MD5 checksum: 585584 53e4002a0df89b66771753616cf363db\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_ia64.deb\r\n Size/MD5 checksum: 521586 98508a5cdfb40353ff957e5f08373db1\r\n\r\n HP Precision architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_hppa.deb\r\n Size/MD5 checksum: 217252 1a50d1a91ef5636cbda13ec4e0f265db\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_hppa.deb\r\n Size/MD5 checksum: 329160 0c48e5ed532768d3d1ebef32af602c4b\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_hppa.deb\r\n Size/MD5 checksum: 584686 ed50b1512e730a3fa6ab426001b5bf67\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_hppa.deb\r\n Size/MD5 checksum: 434434 5f62fa99548ea47b551cfe49922ca234\r\n\r\n Motorola 680x0 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_m68k.deb\r\n Size/MD5 checksum: 198536 3728fd475a5436e9e37477bd288efd69\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_m68k.deb\r\n Size/MD5 checksum: 282770 2a471ea90fc07ea10add0d7e30ba0e1e\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_m68k.deb\r\n Size/MD5 checksum: 560654 dd08dc4c636497eb267c22c841751140\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_m68k.deb\r\n Size/MD5 checksum: 341384 e583af47cd49c87c903f976d155fbf5f\r\n\r\n Big endian MIPS architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_mips.deb\r\n Size/MD5 checksum: 211392 4a592d84dcbb4f9fed9743207843e711\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_mips.deb\r\n Size/MD5 checksum: 291372 811c0397f139dad929b3ab400d5928a7\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_mips.deb\r\n Size/MD5 checksum: 595286 d47c254b672f89115aeafe0006a32498\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_mips.deb\r\n Size/MD5 checksum: 408190 3474ca5c4ea309ee40b94128b300310c\r\n\r\n Little endian MIPS architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_mipsel.deb\r\n Size/MD5 checksum: 211150 4716bf7c71eb01cc0c975bebcafa8371\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_mipsel.deb\r\n Size/MD5 checksum: 290080 1eef0b45a0292bbbbfd31d3afca3a1ef\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_mipsel.deb\r\n Size/MD5 checksum: 590988 e92df52cb9ddb88278e0cc5cd60f2e70\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_mipsel.deb\r\n Size/MD5 checksum: 404250 1c1891c93947f3b7bef2749cf17e3169\r\n\r\n PowerPC architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_powerpc.deb\r\n Size/MD5 checksum: 218138 96738b5cbe1756d7ef3d268f42ab021c\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_powerpc.deb\r\n Size/MD5 checksum: 299210 6103eb0e32b42fa04e6519aba514a5cc\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_powerpc.deb\r\n Size/MD5 checksum: 1415824 a314ee54d3c1f2a13b77b641d7d4a24d\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_powerpc.deb\r\n Size/MD5 checksum: 388604 7ad9f4b250b75798adf5c03bee72af44\r\n\r\n IBM S/390 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_s390.deb\r\n Size/MD5 checksum: 215102 284d41a20d5c7ca8728c0d25aa447da4\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_s390.deb\r\n Size/MD5 checksum: 318308 02063f5177860d5d3ba2e52b95244f89\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_s390.deb\r\n Size/MD5 checksum: 631902 7e63d2fea78676ad888314faced0095e\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_s390.deb\r\n Size/MD5 checksum: 376224 23cef6964011ac02666c83232d30dd40\r\n\r\n Sun Sparc architecture:\r\n\r\n http://security.debian.org/pool/updates/main/g/gnutls11/gnutls-bin_1.0.16-13.2_sparc.deb\r\n Size/MD5 checksum: 204224 b4cf1c065ad8aa91ebb47dfd1995417c\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11_1.0.16-13.2_sparc.deb\r\n Size/MD5 checksum: 295430 b62735044b2d0190f2096edccac74be6\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dbg_1.0.16-13.2_sparc.deb\r\n Size/MD5 checksum: 577102 1d72152342adc1d83b8d3aac39146cca\r\n http://security.debian.org/pool/updates/main/g/gnutls11/libgnutls11-dev_1.0.16-13.2_sparc.deb\r\n Size/MD5 checksum: 399578 b23ff44d73bb2a534d9ab748518c9e23\r\n\r\n\r\n These files will probably be moved into the stable distribution on\r\n its next update.\r\n\r\n- ---------------------------------------------------------------------------------\r\nFor apt-get: deb http://security.debian.org/ stable/updates main\r\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\r\nMailing list: debian-security-announce@lists.debian.org\r\nPackage info: &#96;apt-cache show &lt;pkg&gt;&#39; and http://packages.debian.org/&lt;pkg&gt;\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.2 &#40;GNU/Linux&#41;\r\n\r\niD8DBQFEC+1YW5ql+IAeqTIRAgDhAKCR2pqvDhQHSNEd0qJt+0XpCh5jeQCfXoJ7\r\n4+DeECwkFTOanbCqxlzziJQ=\r\n=E2xx\r\n-----END PGP SIGNATURE-----\r\n\r\n_______________________________________________\r\nFull-Disclosure - We believe in it.\r\nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\r\nHosted and sponsored by Secunia - http://secunia.com/", "modified": "2006-03-06T00:00:00", "published": "2006-03-06T00:00:00", "id": "SECURITYVULNS:DOC:11706", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:11706", "title": "[Full-disclosure] [SECURITY] [DSA 986-1] New gnutls11 packages fix arbitrary code execution", "type": "securityvulns", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:16", "bulletinFamily": "software", "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\n- --------------------------------------------------------------------------\r\nDebian Security Advisory DSA 985-1 security@debian.org\r\nhttp://www.debian.org/security/ Martin Schulze\r\nMarch 6th, 2006 http://www.debian.org/security/faq\r\n- --------------------------------------------------------------------------\r\n\r\nPackage : libtasn1-2\r\nVulnerability : buffer overflows\r\nProblem type : remote\r\nDebian-specific: no\r\nCVE ID : CVE-2006-0645\r\nBugtraq ID : 16568\r\n\r\nEvgeny Legerov discovered several out-of-bounds memory accesses in the\r\nDER decoding component component of the Tiny ASN.1 Library that allows\r\nattackers to crash the DER decoder and possibly execute arbitrary code.\r\n\r\nThe old stable distribution &#40;woody&#41; is not affected by these problems.\r\n\r\nFor the stable distribution &#40;sarge&#41; these problems have been fixed in\r\nversion 2_0.2.10-3sarge1.\r\n\r\nFor the unstable distribution &#40;sid&#41; these problems will be fixed soon.\r\n\r\nWe recommend that you upgrade your gnutls packages.\r\n\r\n\r\nUpgrade Instructions\r\n- --------------------\r\n\r\nwget url\r\n will fetch the file for you\r\ndpkg -i file.deb\r\n will install the referenced file.\r\n\r\nIf you are using the apt-get package manager, use the line for\r\nsources.list as given below:\r\n\r\napt-get update\r\n will update the internal database\r\napt-get upgrade\r\n will install corrected packages\r\n\r\nYou may use an automated update by adding the resources from the\r\nfooter to the proper configuration.\r\n\r\n\r\nDebian GNU/Linux 3.1 alias sarge\r\n- --------------------------------\r\n\r\n Source archives:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1.dsc\r\n Size/MD5 checksum: 670 8666643f13c1feb86814483c36dcb86a\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1.diff.gz\r\n Size/MD5 checksum: 292137 8c9367bd26e7e6b33feb560212229ae8\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10.orig.tar.gz\r\n Size/MD5 checksum: 113412 ae95aa75e5db7dc4d85b2837017364a6\r\n\r\n Alpha architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_alpha.deb\r\n Size/MD5 checksum: 49644 4ef2707cde095b82c58b00bae5ec01cd\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_alpha.deb\r\n Size/MD5 checksum: 198922 1f8a6071d61e39d69b0ca0c143d83165\r\n\r\n AMD64 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_amd64.deb\r\n Size/MD5 checksum: 44460 804a5db0d0ccfd0c45ee1daf66fb8d2b\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_amd64.deb\r\n Size/MD5 checksum: 185776 88ba0556bfbe66bb9857d8d990a16973\r\n\r\n ARM architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_arm.deb\r\n Size/MD5 checksum: 40998 80441d397c5610068d763528d1fa0b85\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_arm.deb\r\n Size/MD5 checksum: 186062 8c061b9a10eb79e975e6ba86652c47fb\r\n\r\n Intel IA-32 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_i386.deb\r\n Size/MD5 checksum: 43460 5948585c89f733b64223d5cda0e9b0b3\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_i386.deb\r\n Size/MD5 checksum: 182750 0070e40570d4b57dcbd696a8bca3ef32\r\n\r\n Intel IA-64 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_ia64.deb\r\n Size/MD5 checksum: 59434 c354bb099c7a7ff0b83b4ce4b201f134\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_ia64.deb\r\n Size/MD5 checksum: 200622 360eef8f745b5e20dced7eb2f9b7b283\r\n\r\n HP Precision architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_hppa.deb\r\n Size/MD5 checksum: 47664 0ef077cc156e5590e44a26ec85c99a49\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_hppa.deb\r\n Size/MD5 checksum: 187158 4f446f584c50416f5a94c2765eca734e\r\n\r\n Motorola 680x0 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_m68k.deb\r\n Size/MD5 checksum: 39532 9c954f1aa9cc9ca6be038cba975547f6\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_m68k.deb\r\n Size/MD5 checksum: 178254 d2654672c4e00ff79f300240c0863511\r\n\r\n Big endian MIPS architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_mips.deb\r\n Size/MD5 checksum: 47068 a62291b5f623efeb663ba8d74768184f\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_mips.deb\r\n Size/MD5 checksum: 187780 7d619e82628bd9a0511eb604e258a7cc\r\n\r\n Little endian MIPS architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_mipsel.deb\r\n Size/MD5 checksum: 47106 66f753671aa3f743d3b28a53ac9c65b7\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_mipsel.deb\r\n Size/MD5 checksum: 187744 8abeac81b2d6101e8ec322ef43a7a42a\r\n\r\n PowerPC architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_powerpc.deb\r\n Size/MD5 checksum: 43042 9cb6b6c8282f2b5771cd6bdceab35767\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_powerpc.deb\r\n Size/MD5 checksum: 187828 54b7db1b1c0f64f846229d58855b723b\r\n\r\n IBM S/390 architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_s390.deb\r\n Size/MD5 checksum: 45394 918971380ceb9ff90d76b9961cc8498f\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_s390.deb\r\n Size/MD5 checksum: 185462 2e79e42a24786d899a7500d1626fe164\r\n\r\n Sun Sparc architecture:\r\n\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2_0.2.10-3sarge1_sparc.deb\r\n Size/MD5 checksum: 41776 73e43f3d0917933529c3688b67b08957\r\n http://security.debian.org/pool/updates/main/libt/libtasn1-2/libtasn1-2-dev_0.2.10-3sarge1_sparc.deb\r\n Size/MD5 checksum: 183816 bef29056f86d10dac454d0bedd6f52cb\r\n\r\n\r\n These files will probably be moved into the stable distribution on\r\n its next update.\r\n\r\n- ---------------------------------------------------------------------------------\r\nFor apt-get: deb http://security.debian.org/ stable/updates main\r\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\r\nMailing list: debian-security-announce@lists.debian.org\r\nPackage info: &#96;apt-cache show &lt;pkg&gt;&#39; and http://packages.debian.org/&lt;pkg&gt;\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG v1.4.2 &#40;GNU/Linux&#41;\r\n\r\niD8DBQFEC9yeW5ql+IAeqTIRAnr+AJsF0PkMhK03lUU/uiXw/m518mKKwACgtPsZ\r\nw0ZIgIJgKPkuUldM/Zyuk4I=\r\n=rRsX\r\n-----END PGP SIGNATURE-----\r\n\r\n_______________________________________________\r\nFull-Disclosure - We believe in it.\r\nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\r\nHosted and sponsored by Secunia - http://secunia.com/", "modified": "2006-03-06T00:00:00", "published": "2006-03-06T00:00:00", "id": "SECURITYVULNS:DOC:11705", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:11705", "title": "[Full-disclosure] [SECURITY] [DSA 985-1] New libtasn1-2 packages fix arbitrary code execution", "type": "securityvulns", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "ubuntu": [{"lastseen": "2018-08-31T00:08:39", "bulletinFamily": "unix", "description": "Evgeny Legerov discovered a buffer overflow in the DER format decoding function of the libtasn library. This library is mainly used by the GNU TLS library; by sending a specially crafted X.509 certificate to a server which uses TLS encryption/authentication, a remote attacker could exploit this to crash that server process and possibly even execute arbitrary code with the privileges of that server.\n\nIn order to fix the vulnerability in libtasn, several internal function signatures had to be changed; some of these functions are used by the GNU TLS library, so that library needs to be updated as well.", "modified": "2006-02-17T00:00:00", "published": "2006-02-17T00:00:00", "id": "USN-251-1", "href": "https://usn.ubuntu.com/251-1/", "title": "libtasn vulnerability", "type": "ubuntu", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "centos": [{"lastseen": "2017-10-12T14:44:52", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2006:0207\n\n\nThe GNU TLS Library provides support for cryptographic algorithms and\r\nprotocols such as TLS. GNU TLS includes Libtasn1, a library developed for\r\nASN.1 structures management that includes DER encoding and decoding.\r\n\r\nSeveral flaws were found in the way libtasn1 decodes DER. An attacker\r\ncould create a carefully crafted invalid X.509 certificate in such a way\r\nthat could trigger this flaw if parsed by an application that uses GNU TLS.\r\nThis could lead to a denial of service (application crash). It is not\r\ncertain if this issue could be escalated to allow arbitrary code execution. \r\nThe Common Vulnerabilities and Exposures project assigned the name\r\nCVE-2006-0645 to this issue.\r\n\r\nIn Red Hat Enterprise Linux 4, the GNU TLS library is only used by the\r\nEvolution client when connecting to an Exchange server or when publishing\r\ncalendar information to a WebDAV server.\r\n\r\nUsers are advised to upgrade to these updated packages, which contain a\r\nbackported patch from the GNU TLS maintainers to correct this issue.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2006-February/012632.html\nhttp://lists.centos.org/pipermail/centos-announce/2006-February/012633.html\nhttp://lists.centos.org/pipermail/centos-announce/2006-February/012634.html\nhttp://lists.centos.org/pipermail/centos-announce/2006-February/012635.html\nhttp://lists.centos.org/pipermail/centos-announce/2006-February/012636.html\n\n**Affected packages:**\ngnutls\ngnutls-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2006-0207.html", "modified": "2006-02-12T01:22:09", "published": "2006-02-10T22:21:21", "href": "http://lists.centos.org/pipermail/centos-announce/2006-February/012632.html", "id": "CESA-2006:0207", "title": "gnutls security update", "type": "centos", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "osvdb": [{"lastseen": "2017-04-28T13:20:19", "bulletinFamily": "software", "description": "## Solution Description\nUpgrade to version 0.2.18 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## References:\nVendor Specific News/Changelog Entry: http://www.gnu.org/software/gnutls/security.html\n[Vendor Specific Advisory URL](http://www.debian.org/security/2006/dsa-986)\n[Vendor Specific Advisory URL](http://www.debian.org/security/2006/dsa-985)\n[Vendor Specific Advisory URL](http://www.ubuntu.com/usn/usn-251-1)\n[Vendor Specific Advisory URL](http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2006:039)\n[Vendor Specific Advisory URL](http://security.gentoo.org/glsa/glsa-200602-08.xml)\n[Vendor Specific Advisory URL](http://www.trustix.org/errata/2006/0008/)\nSecurity Tracker: 1015612\n[Secunia Advisory ID:18830](https://secuniaresearch.flexerasoftware.com/advisories/18830/)\n[Secunia Advisory ID:18918](https://secuniaresearch.flexerasoftware.com/advisories/18918/)\n[Secunia Advisory ID:18832](https://secuniaresearch.flexerasoftware.com/advisories/18832/)\n[Secunia Advisory ID:18815](https://secuniaresearch.flexerasoftware.com/advisories/18815/)\n[Secunia Advisory ID:18898](https://secuniaresearch.flexerasoftware.com/advisories/18898/)\n[Secunia Advisory ID:18794](https://secuniaresearch.flexerasoftware.com/advisories/18794/)\n[Secunia Advisory ID:19015](https://secuniaresearch.flexerasoftware.com/advisories/19015/)\n[Secunia Advisory ID:19080](https://secuniaresearch.flexerasoftware.com/advisories/19080/)\n[Secunia Advisory ID:19092](https://secuniaresearch.flexerasoftware.com/advisories/19092/)\nRedHat RHSA: RHSA-2006:0207\nMail List Post: http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html\nMail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0161.html\n[CVE-2006-0645](https://vulners.com/cve/CVE-2006-0645)\nBugtraq ID: 16568\n", "modified": "2006-02-09T05:02:50", "published": "2006-02-09T05:02:50", "href": "https://vulners.com/osvdb/OSVDB:23054", "id": "OSVDB:23054", "title": "GnuTLS libtasn1 DER Decoding Overflow DoS", "type": "osvdb", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}