lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.

SecurityFocus reports :

GnuTLS is prone to multiple remote vulnerabilities :

- A remote code-execution vulnerability.

- A denial-of-service vulnerability.

- A signature-generation vulnerability.

- A signature-verification vulnerability.

An attacker can exploit these issues to potentially execute arbitrary code, trigger denial-of-service conditions, carry out attacks against data signed with weak signatures, and cause clients to accept expired or invalid certificates from servers.

The remote host is affected by the vulnerability described in GLSA-200905-04 (GnuTLS: Multiple vulnerabilities)

    The following vulnerabilities were found in GnuTLS:
    Miroslav Kratochvil reported that lib/pk-libgcrypt.c does not     properly handle corrupt DSA signatures, possibly leading to a     double-free vulnerability (CVE-2009-1415).
    Simon Josefsson     reported that GnuTLS generates RSA keys stored in DSA structures when     creating a DSA key (CVE-2009-1416).
    Romain Francoise reported     that the _gnutls_x509_verify_certificate() function in     lib/x509/verify.c does not perform time checks, resulting in the     'gnutls-cli' program accepting X.509 certificates with validity times     in the past or future (CVE-2009-1417).
  Impact :

    A remote attacker could entice a user or automated system to process a     specially crafted DSA certificate, possibly resulting in a Denial of     Service condition. NOTE: This issue might have other unspecified impact     including the execution of arbitrary code. Furthermore, a remote     attacker could spoof signatures on certificates and the 'gnutls-cli'     application can be tricked into accepting an invalid certificate.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities has been found and corrected in gnutls :

lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free (CVE-2009-1415).

lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key (CVE-2009-1416).

gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the
_gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup (CVE-2009-1417).

The updated packages have been patched to prevent this.

New gnutls packages are available for Slackware 12.0, 12.1, 12.2, and
-current to fix security issues.

ID	Name	Product	Family	Severity
40661	FreeBSD : GnuTLS -- multiple vulnerabilities (b31a1088-460f-11de-a11a-0022156e8794)	Nessus	FreeBSD Local Security Checks	high
38885	GLSA-200905-04 : GnuTLS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
38815	Mandriva Linux Security Advisory : gnutls (MDVSA-2009:116)	Nessus	Mandriva Local Security Checks	high
38719	Slackware 12.0 / 12.1 / 12.2 / current : gnutls (SSA:2009-128-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2009-1415

critical

Tenable Plugins

high

high

high

high