The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party libraries :

  - GnuTLS
  - Kernel
  - OpenSSL

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fix CVE-2015-0282 (#1198159)

  - fix CVE-2015-0294 (#1198159)

  - Corrected value initialization in mpi printing     (#1129241)

  - Check for expiry information in the CA certificates     (#1159778)

  - fix issue with integer padding in certificates and keys     (#1036385)

  - fix session ID length check (#1102025)

  - fix CVE-2014-0092 (#1069891)

  - fix CVE-2013-2116 - fix DoS regression in     (CVE-2013-1619) upstream patch (#966754)

  - fix CVE-2013-1619 - fix TLS-CBC timing attack (#908238)

The remote Solaris system is missing necessary patches to address security updates :

  - The TLS implementation in GnuTLS before 2.12.23, 3.0.x     before 3.0.28, and 3.1.x before 3.1.7 does not properly     consider timing side-channel attacks on a noncompliant     MAC check operation during the processing of malformed     CBC padding, which allows remote attackers to conduct     distinguishing attacks and plaintext-recovery attacks     via statistical analysis of timing data for crafted     packets, a related issue to CVE-2013-0169.
    (CVE-2013-1619)

  - The _gnutls_ciphertext2compressed function in     lib/gnutls_cipher.c in GnuTLS 2.12.23 allows remote     attackers to cause a denial of service (buffer over-read     and crash) via a crafted padding length. NOTE: this     might be due to an incorrect fix for CVE-2013-0169.
    (CVE-2013-2116)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:1076 advisory.

    The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization     Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor     is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes     everything necessary to run and manage virtual machines: A subset of the     Red Hat Enterprise Linux operating environment and the Red Hat Enterprise     Virtualization Agent.

    Note: Red Hat Enterprise Virtualization Hypervisor is only available for     the Intel 64 and AMD64 architectures with virtualization extensions.

    It was discovered that the fix for the CVE-2013-1619 issue released via     RHSA-2013:0636 introduced a regression in the way GnuTLS decrypted TLS/SSL     encrypted records when CBC-mode cipher suites were used. A remote attacker     could possibly use this flaw to crash a server or client application that     uses GnuTLS. (CVE-2013-2116)

    This updated package provides updated components that include fixes for     various security issues. These issues have no security impact on Red Hat     Enterprise Virtualization Hypervisor itself, however. The security fixes     included in this update address the following CVE numbers:

    CVE-2013-2174 (curl issue)

    CVE-2012-6548, CVE-2013-0914, CVE-2013-1848, CVE-2013-2128, CVE-2013-2634,     CVE-2013-2635, CVE-2013-2852, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225,     and CVE-2013-3301 (kernel issues)

    CVE-2002-2443 (krb5 issue)

    CVE-2013-1950 (libtirpc issue)

    Upgrade Note: If you upgrade the Red Hat Enterprise Virtualization     Hypervisor through the 3.2 Manager administration portal, the Host may     appear with the status of Install Failed. If this happens, place the host     into maintenance mode, then activate it again to get the host back to an     Up state.

    This update also contains the fixes from the following errata:

    * ovirt-node: RHBA-2013:1077

    Users of the Red Hat Enterprise Virtualization Hypervisor are advised to     upgrade to this updated package, which corrects these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201310-18 (GnuTLS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GnuTLS. Please review       the CVE identifiers and Lucky Thirteen research paper referenced below       for details.
  Impact :

    A remote attacker could sent a specially crafted packet to cause a       Denial of Service condition. Additionally, a remote attacker could       perform man-in-the-middle attacks to recover plaintext data.
  Workaround :

    There is no known workaround at this time.

New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1, and 13.37 to fix security issues.

It was discovered that the fix for the CVE-2013-1619 issue introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. (CVE-2013-2116)

a. vCenter Server and ESX userworld update for OpenSSL library

   The userworld OpenSSL library is updated to version openssl-0.9.8y    to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2013-0169 and CVE-2013-0166 to these    issues.

b. Service Console (COS) update for OpenSSL library

   The Service Console updates for OpenSSL library is updated to version    openssl-0.9.8e-26.el5_9.1 to resolve multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2013-0169 and CVE-2013-0166 to these    issues.

c. ESX Userworld and Service Console (COS) update for libxml2 library 

   The ESX Userworld and Service Console libxml2 library is updated to    version libxml2-2.6.26-2.1.21.el5_9.1 and    libxml2-python-2.6.26-2.1.21.el5_9.1. to resolve a security issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-0338 to this issue.

d. Service Console (COS) update for GnuTLS library 

   The ESX service console GnuTLS RPM is updated to version    gnutls-1.4.1-10.el5_9.1 to resolve a security issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2013-2116 to this issue.

e. ESX third-party update for Service Console kernel 

   The ESX Service Console Operating System (COS) kernel is updated    to kernel-2.6.18-348.3.1.el5 which addresses several security    issues in the COS kernel. 

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2013-0268 and CVE-2013-0871 to these    issues.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0883 advisory.

    [2.8.5-10.2]
    - fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619       upstream patch (#966754)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Important security update - possible DoS of both client and server.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix for CVE-2013-2116.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of GnuTLS fixes a regression introduced by the previous update that could have resulted in a Denial of Service (application crash).

It was discovered that the fix for the CVE-2013-1619 issue released via SLSA-2013:0588 introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. (CVE-2013-2116)

For the update to take effect, all applications linked to the GnuTLS library must be restarted.

Updated gnutls packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).

It was discovered that the fix for the CVE-2013-1619 issue released via RHSA-2013:0588 introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. (CVE-2013-2116)

Users of GnuTLS are advised to upgrade to these updated packages, which correct this issue. For the update to take effect, all applications linked to the GnuTLS library must be restarted.

It was discovered that GnuTLS incorrectly handled certain padding bytes. A remote attacker could use this flaw to cause an application using GnuTLS to crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that a malicious client could crash a GNUTLS server and vice versa, by sending TLS records encrypted with a block cipher which contain invalid padding.

The oldstable distribution (squeeze) is not affected because the security fix that introduced this vulnerability was not applied to it.

ID	Name	Product	Family	Severity
89666	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2013-0009) (remote check)	Nessus	Misc.	medium
85142	OracleVM 3.3 : gnutls (OVMSA-2015-0101)	Nessus	OracleVM Local Security Checks	high
80630	Oracle Solaris Third-Party Patch Update : gnutls (cve_2013_1619_cryptographic_issues)	Nessus	Solaris Local Security Checks	medium
78965	RHEL 6 : rhev-hypervisor6 (RHSA-2013:1076)	Nessus	Red Hat Local Security Checks	high
78199	F5 Networks BIG-IP : GnuTLS vulnerability (SOL15637)	Nessus	F5 Networks Local Security Checks	medium
70674	GLSA-201310-18 : GnuTLS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
70439	Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 : gnutls (SSA:2013-287-03)	Nessus	Slackware Local Security Checks	medium
69755	Amazon Linux AMI : gnutls (ALAS-2013-197)	Nessus	Amazon Linux Local Security Checks	medium
69193	VMSA-2013-0009 : VMware vSphere, ESX and ESXi updates to third-party libraries	Nessus	VMware ESX Local Security Checks	medium
68829	Oracle Linux 5 / 6 : gnutls (ELSA-2013-0883)	Nessus	Oracle Linux Local Security Checks	high
67384	Fedora 17 : gnutls-2.12.23-2.fc17 (2013-9799)	Nessus	Fedora Local Security Checks	medium
67381	Fedora 18 : gnutls-2.12.23-2.fc18 (2013-9792)	Nessus	Fedora Local Security Checks	medium
67379	Fedora 18 : mingw-gnutls-2.12.23-2.fc18 (2013-9783)	Nessus	Fedora Local Security Checks	medium
67378	Fedora 17 : mingw-gnutls-2.12.23-2.fc17 (2013-9774)	Nessus	Fedora Local Security Checks	medium
66957	SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 8616)	Nessus	SuSE Local Security Checks	medium
66954	SuSE 11.2 / 11.3 Security Update : GnuTLS (SAT Patch Numbers 7781 / 7918)	Nessus	SuSE Local Security Checks	medium
66708	Scientific Linux Security Update : gnutls on SL5.x, SL6.x i386/srpm/x86_64 (20130530)	Nessus	Scientific Linux Local Security Checks	medium
66706	RHEL 5 / 6 : gnutls (RHSA-2013:0883)	Nessus	Red Hat Local Security Checks	medium
66701	CentOS 5 / 6 : gnutls (CESA-2013:0883)	Nessus	CentOS Local Security Checks	medium
66692	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : gnutls26 vulnerability (USN-1843-1)	Nessus	Ubuntu Local Security Checks	medium
66678	Debian DSA-2697-1 : gnutls26 - out-of-bounds array read	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-2116

high

Tenable Plugins

medium

high

medium

high

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium