Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title GnuTLS vulnerabilities
Informations
Name USN-613-1 First vendor Publication 2008-05-21
Vendor Ubuntu Last vendor Modification 2008-05-21
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS Ubuntu 7.04 Ubuntu 7.10 Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 6.06 LTS:
libgnutls12 1.2.9-2ubuntu1.2

Ubuntu 7.04:
libgnutls13 1.4.4-3ubuntu0.1

Ubuntu 7.10:
libgnutls13 1.6.3-1ubuntu0.1

Ubuntu 8.04 LTS:
libgnutls13 2.0.4-1ubuntu2.1

After a standard system upgrade you need to reboot your computer to effect the necessary changes.

Details follow:

Multiple flaws were discovered in the connection handling of GnuTLS. A remote attacker could exploit this to crash applications linked against GnuTLS, or possibly execute arbitrary code with permissions of the application's user.

Original Source

Url : http://www.ubuntu.com/usn/USN-613-1

CWE : Common Weakness Enumeration

% Id Name
67 % CWE-189 Numeric Errors (CWE/SANS Top 25)
33 % CWE-287 Improper Authentication

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10935
 
Oval ID: oval:org.mitre.oval:def:10935
Title: The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.
Description: The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1948
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11393
 
Oval ID: oval:org.mitre.oval:def:11393
Title: Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.
Description: Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1950
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17521
 
Oval ID: oval:org.mitre.oval:def:17521
Title: USN-613-1 -- gnutls12, gnutls13 vulnerabilities
Description: Multiple flaws were discovered in the connection handling of GnuTLS.
Family: unix Class: patch
Reference(s): USN-613-1
CVE-2008-1948
CVE-2008-1949
CVE-2008-1950
Version: 7
Platform(s): Ubuntu 6.06
Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04
Product(s): gnutls12
gnutls13
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19997
 
Oval ID: oval:org.mitre.oval:def:19997
Title: DSA-1581-1 gnutls13 - potential code execution
Description: Several remote vulnerabilities have been discovered in GNUTLS, an implementation of the SSL/TLS protocol suite.
Family: unix Class: patch
Reference(s): DSA-1581-1
CVE-2008-1948
CVE-2008-1949
CVE-2008-1950
Version: 5
Platform(s): Debian GNU/Linux 4.0
Product(s): gnutls13
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22264
 
Oval ID: oval:org.mitre.oval:def:22264
Title: ELSA-2008:0489: gnutls security update (Critical)
Description: Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.
Family: unix Class: patch
Reference(s): ELSA-2008:0489-01
CVE-2008-1948
CVE-2008-1949
CVE-2008-1950
Version: 17
Platform(s): Oracle Linux 5
Product(s): gnutls
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:7887
 
Oval ID: oval:org.mitre.oval:def:7887
Title: DSA-1581 gnutls13 -- several vulnerabilities
Description: Several remote vulnerabilities have been discovered in GNUTLS, an implementation of the SSL/TLS protocol suite. NOTE: The libgnutls13 package, which provides the GNUTLS library, does not contain logic to automatically restart potentially affected services. You must restart affected services manually (mainly Exim, using /etc/init.d/exim4 restart) after applying the update, to make the changes fully effective. Alternatively, you can reboot the system. The Common Vulnerabilities and Exposures project identifies the following problems: A pre-authentication heap overflow involving oversized session resumption data may lead to arbitrary code execution. Repeated client hellos may result in a pre-authentication denial of service condition due to a null pointer dereference. Decoding cipher padding with an invalid record length may cause GNUTLS to read memory beyond the end of the received record, leading to a pre-authentication denial of service condition.
Family: unix Class: patch
Reference(s): DSA-1581
CVE-2008-1948
CVE-2008-1949
CVE-2008-1950
Version: 3
Platform(s): Debian GNU/Linux 4.0
Product(s): gnutls13
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9519
 
Oval ID: oval:org.mitre.oval:def:9519
Title: The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.
Description: The _gnutls_recv_client_kx_message function in lib/gnutls_kx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service (NULL dereference and crash) via a TLS message containing multiple Client Hello messages, aka GNUTLS-SA-2008-1-2.
Family: unix Class: vulnerability
Reference(s): CVE-2008-1949
Version: 5
Platform(s): Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 105

OpenVAS Exploits

Date Description
2009-10-13 Name : SLES10: Security update for GnuTLS
File : nvt/sles10_gnutls1.nasl
2009-10-10 Name : SLES9: Security update for GnuTLS
File : nvt/sles9p5035527.nasl
2009-04-09 Name : Mandriva Update for gnutls MDVSA-2008:106 (gnutls)
File : nvt/gb_mandriva_MDVSA_2008_106.nasl
2009-03-23 Name : Ubuntu Update for gnutls12, gnutls13 vulnerabilities USN-613-1
File : nvt/gb_ubuntu_USN_613_1.nasl
2009-03-06 Name : RedHat Update for gnutls RHSA-2008:0489-01
File : nvt/gb_RHSA-2008_0489-01_gnutls.nasl
2009-03-06 Name : RedHat Update for gnutls RHSA-2008:0492-01
File : nvt/gb_RHSA-2008_0492-01_gnutls.nasl
2009-02-17 Name : Fedora Update for gnutls FEDORA-2008-4183
File : nvt/gb_fedora_2008_4183_gnutls_fc8.nasl
2009-02-17 Name : Fedora Update for gnutls FEDORA-2008-4259
File : nvt/gb_fedora_2008_4259_gnutls_fc9.nasl
2009-02-17 Name : Fedora Update for gnutls FEDORA-2008-4274
File : nvt/gb_fedora_2008_4274_gnutls_fc7.nasl
2009-01-23 Name : SuSE Update for gnutls SUSE-SA:2008:046
File : nvt/gb_suse_2008_046.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200805-20 (gnutls)
File : nvt/glsa_200805_20.nasl
2008-09-06 Name : GnuTLS < 2.2.5 vulnerability (Lin)
File : nvt/gnutls_CB-A08-0079.nasl
2008-09-06 Name : GnuTLS < 2.2.4 vulnerability (Win)
File : nvt/smbcl_gnutls_CB-A08-0079.nasl
2008-05-27 Name : Debian Security Advisory DSA 1581-1 (gnutls13)
File : nvt/deb_1581_1.nasl
0000-00-00 Name : Slackware Advisory SSA:2008-180-01 gnutls
File : nvt/esoft_slk_ssa_2008_180_01.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
45384 GnuTLS libgnutls lib/gnutls_cipher.c _gnutls_ciphertext2compressed Function T...

45383 GnuTLS gnutls-serv libgnutls lib/gnutls_kx.c _gnutls_recv_client_kx_message F...

45382 GnuTLS gnutls-serv libgnutls lib/ext_server_name.c _gnutls_server_name_recv_p...

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0492.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2008-0489.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080520_gnutls_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20080520_gnutls_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0489.nasl - Type : ACT_GATHER_INFO
2010-01-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2008-0492.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12230.nasl - Type : ACT_GATHER_INFO
2009-09-24 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gnutls-5543.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-106.nasl - Type : ACT_GATHER_INFO
2008-09-16 Name : The remote openSUSE host is missing a security update.
File : suse_gnutls-5275.nasl - Type : ACT_GATHER_INFO
2008-09-16 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_gnutls-5601.nasl - Type : ACT_GATHER_INFO
2008-07-02 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2008-180-01.nasl - Type : ACT_GATHER_INFO
2008-06-30 Name : The remote Windows host contains a media player that is affected by several v...
File : vlc_0_8_6h.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Fedora host is missing a security update.
File : fedora_2008-4259.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Fedora host is missing a security update.
File : fedora_2008-4274.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200805-20.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Fedora host is missing a security update.
File : fedora_2008-4183.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1581.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0489.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2008-0492.nasl - Type : ACT_GATHER_INFO
2008-05-22 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-613-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 12:05:09
  • Multiple Updates