Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.850991
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory for gnutls (SUSE-SU-2014:0322-1)
Summary:The remote host is missing an update for the 'gnutls'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'gnutls'
package(s) announced via the referenced advisory.

Vulnerability Insight:
The GnuTLS library received a critical security fix and
other updates:

* CVE-2014-0092: The X.509 certificate verification had
incorrect error handling, which could lead to broken
certificates marked as being valid.

* CVE-2009-5138: A verification problem in handling V1
certificates could also lead to V1 certificates incorrectly
being handled.

* CVE-2013-2116: The _gnutls_ciphertext2compressed
function in lib/gnutls_cipher.c in GnuTLS allowed remote
attackers to cause a denial of service (buffer over-read
and crash) via a crafted padding length.

* CVE-2013-1619: Timing attacks against hashing of
padding was fixed which might have allowed disclosure of
keys. (Lucky13 attack).

Also the following non-security bugs have been fixed:

* gnutls doesn't like root CAs without Basic
Constraints. Permit V1 Certificate Authorities properly
(bnc#760265)

* memory leak in PSK authentication (bnc#835760)

Affected Software/OS:
gnutls on SUSE Linux Enterprise Server 11 SP1 LTSS

Solution:
Please install the updated package(s).

CVSS Score:
5.8

CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:N

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2009-5138
http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351/focus=3361
http://article.gmane.org/gmane.comp.security.oss.general/12223
http://thread.gmane.org/gmane.comp.security.oss.general/12127
RedHat Security Advisories: RHSA-2014:0247
http://rhn.redhat.com/errata/RHSA-2014-0247.html
http://secunia.com/advisories/57254
http://secunia.com/advisories/57260
http://secunia.com/advisories/57274
http://secunia.com/advisories/57321
SuSE Security Announcement: SUSE-SU-2014:0319 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00000.html
SuSE Security Announcement: SUSE-SU-2014:0320 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
SuSE Security Announcement: SUSE-SU-2014:0322 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html
SuSE Security Announcement: SUSE-SU-2014:0445 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00020.html
Common Vulnerability Exposure (CVE) ID: CVE-2013-1619
http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
http://openwall.com/lists/oss-security/2013/02/05/24
RedHat Security Advisories: RHSA-2013:0588
http://rhn.redhat.com/errata/RHSA-2013-0588.html
SuSE Security Announcement: openSUSE-SU-2013:0807 (Google Search)
http://lists.opensuse.org/opensuse-updates/2013-05/msg00023.html
SuSE Security Announcement: openSUSE-SU-2014:0346 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00009.html
http://www.ubuntu.com/usn/USN-1752-1
Common Vulnerability Exposure (CVE) ID: CVE-2013-2116
Debian Security Information: DSA-2697 (Google Search)
http://www.debian.org/security/2013/dsa-2697
http://www.mandriva.com/security/advisories?name=MDVSA-2013:171
http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/6753
RedHat Security Advisories: RHSA-2013:0883
http://rhn.redhat.com/errata/RHSA-2013-0883.html
http://www.securitytracker.com/id/1028603
http://secunia.com/advisories/53911
SuSE Security Announcement: SUSE-SU-2013:1060 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00019.html
http://www.ubuntu.com/usn/USN-1843-1
Common Vulnerability Exposure (CVE) ID: CVE-2014-0092
BugTraq ID: 65919
http://www.securityfocus.com/bid/65919
Debian Security Information: DSA-2869 (Google Search)
http://www.debian.org/security/2014/dsa-2869
RedHat Security Advisories: RHSA-2014:0246
http://rhn.redhat.com/errata/RHSA-2014-0246.html
RedHat Security Advisories: RHSA-2014:0288
http://rhn.redhat.com/errata/RHSA-2014-0288.html
RedHat Security Advisories: RHSA-2014:0339
http://rhn.redhat.com/errata/RHSA-2014-0339.html
http://secunia.com/advisories/56933
http://secunia.com/advisories/57103
http://secunia.com/advisories/57204
SuSE Security Announcement: SUSE-SU-2014:0321 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00002.html
SuSE Security Announcement: SUSE-SU-2014:0323 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html
SuSE Security Announcement: SUSE-SU-2014:0324 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00005.html
SuSE Security Announcement: openSUSE-SU-2014:0325 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00006.html
SuSE Security Announcement: openSUSE-SU-2014:0328 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00007.html
http://www.ubuntu.com/usn/USN-2127-1
CopyrightCopyright (C) 2015 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.