GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gnutls: incorrect handling of V1 intermediate certificates (CVE-2009-5138)

  - gnutls: incorrect error handling in certificate verification (GNUTLS-SA-2014-2) (CVE-2014-0092)

  - Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before     2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows     remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.
    (CVE-2011-4128)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The GnuTLS library received a critical security fix and other updates :

  - CVE-2014-0092: The X.509 certificate verification had     incorrect error handling, which could lead to broken     certificates marked as being valid.

  - CVE-2009-5138: A verification problem in handling V1     certificates could also lead to V1 certificates     incorrectly being handled.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092)

A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid. (CVE-2009-5138)

The CVE-2014-0092 issue was discovered by Nikos Mavrogiannopoulos of the Red Hat Security Technologies Team.

Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS library must be restarted.

The GnuTLS library received a critical security fix and other updates :

  - The X.509 certificate verification had incorrect error     handling, which could lead to broken certificates marked     as being valid. (CVE-2014-0092)

  - A verification problem in handling V1 certificates could     also lead to V1 certificates incorrectly being handled.
    Additionally a memory leak in PSK authentication has     been fixed. (bnc#835760). (CVE-2009-5138)

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092)

A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid. (CVE-2009-5138)

For the update to take effect, all applications linked to the GnuTLS library must be restarted.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0247 advisory.

    - fix issues of CVE-2014-0092 (#1069888)
    - fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619       upstream patch (#966754)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
198544	RHEL 6 : mingw32-gnutls (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
83612	SUSE SLES10 Security Update : gnutls (SUSE-SU-2014:0321-1)	Nessus	SuSE Local Security Checks	medium
72804	CentOS 5 : gnutls (CESA-2014:0247)	Nessus	CentOS Local Security Checks	medium
72797	SuSE 11.3 Security Update : gnutls (SAT Patch Number 8949)	Nessus	SuSE Local Security Checks	medium
72795	Scientific Linux Security Update : gnutls on SL5.x i386/x86_64 (20140303)	Nessus	Scientific Linux Local Security Checks	medium
72794	RHEL 5 : gnutls (RHSA-2014:0247)	Nessus	Red Hat Local Security Checks	medium
72792	Oracle Linux 5 : gnutls (ELSA-2014-0247)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2009-5138

high

Tenable Plugins

high

medium

medium

medium

medium

medium

high