The gnutls_x509_dn_oid_name function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN.

Updated gnutls packages fix security vulnerabilities :

Suman Jana reported a vulnerability that affects the certificate verification functions of gnutls 3.1.x and gnutls 3.2.x. A version 1 intermediate certificate will be considered as a CA certificate by default (something that deviates from the documented behavior) (CVE-2014-1959).

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker (CVE-2014-0092).

A NULL pointer dereference flaw was discovered in GnuTLS's gnutls_x509_dn_oid_name(). The function, when called with the GNUTLS_X509_DN_OID_RETURN_OID flag, should not return NULL to its caller. However, it could previously return NULL when parsed X.509 certificates included specific OIDs (CVE-2014-3465).

A flaw was found in the way GnuTLS parsed session ids from Server Hello packets of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session id value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code (CVE-2014-3466).

An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR). A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application (CVE-2014-8564).

The remote Solaris system is missing necessary patches to address security updates :

  - The gnutls_x509_dn_oid_name function in     lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x     before 3.2.10 allows remote attackers to cause a denial     of service (NULL pointer dereference) via a crafted     X.509 certificate, related to a missing LDAP description     for an OID when printing the DN. (CVE-2014-3465)

  - Buffer overflow in the read_server_hello function in     lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x     before 3.2.15, and 3.3.x before 3.3.4 allows remote     servers to cause a denial of service (memory corruption)     or possibly execute arbitrary code via a long session id     in a ServerHello message. (CVE-2014-3466)

  - Multiple unspecified vulnerabilities in the DER decoder     in GNU Libtasn1 before 3.6, as used in GnutTLS, allow     remote attackers to cause a denial of service     (out-of-bounds read) via a crafted ASN.1 data.
    (CVE-2014-3467)

  - The asn1_get_bit_der function in GNU Libtasn1 before 3.6     does not properly report an error when a negative bit     length is identified, which allows context-dependent     attackers to cause out-of-bounds access via crafted     ASN.1 data. (CVE-2014-3468)

  - The (1) asn1_read_value_type and (2) asn1_read_value     functions in GNU Libtasn1 before 3.6 allows     context-dependent attackers to cause a denial of service     (NULL pointer dereference and crash) via a NULL value in     an ivalue argument. (CVE-2014-3469)

Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).

A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code. (CVE-2014-3466)

A NULL pointer dereference flaw was found in the way GnuTLS parsed X.509 certificates. A specially crafted certificate could cause a server or client application using GnuTLS to crash. (CVE-2014-3465)

Red Hat would like to thank GnuTLS upstream for reporting these issues. Upstream acknowledges Joonas Kuorilehto of Codenomicon as the original reporter of CVE-2014-3466.

Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS library must be restarted.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0684 advisory.

    [3.1.18-9]
    - fix session ID length check (#1102027)
    - fixes null pointer dereference (#1101727)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201406-09 (GnuTLS: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GnuTLS. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could utilize multiple vectors to spoof arbitrary SSL       servers via a crafted certificate, execute arbitrary code or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

gnutls was patched to fix two security vulnerabilities that could be used to disrupt service or potentially allow remote code execution.

  - Memory corruption during connect (CVE-2014-3466)

  - NULL pointer dereference in gnutls_x509_dn_oid_name     (CVE-2014-3465)

Updated gnutls packages fix security vulnerabilities :

A NULL pointer dereference flaw was discovered in GnuTLS's gnutls_x509_dn_oid_name(). The function, when called with the GNUTLS_X509_DN_OID_RETURN_OID flag, should not return NULL to its caller. However, it could previously return NULL when parsed X.509 certificates included specific OIDs (CVE-2014-3465).

A flaw was found in the way GnuTLS parsed session ids from Server Hello packets of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session id value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code (CVE-2014-3466).

New gnutls packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

ID	Name	Product	Family	Severity
82325	Mandriva Linux Security Advisory : gnutls (MDVSA-2015:072)	Nessus	Mandriva Local Security Checks	medium
80632	Oracle Solaris Third-Party Patch Update : gnutls (multiple_vulnerabilities_in_gnutls)	Nessus	Solaris Local Security Checks	medium
76893	RHEL 7 : gnutls (RHSA-2014:0684)	Nessus	Red Hat Local Security Checks	medium
76731	Oracle Linux 7 : gnutls (ELSA-2014-0684)	Nessus	Oracle Linux Local Security Checks	high
76061	GLSA-201406-09 : GnuTLS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
75384	openSUSE Security Update : gnutls (openSUSE-SU-2014:0763-1)	Nessus	SuSE Local Security Checks	medium
74417	Mandriva Linux Security Advisory : gnutls (MDVSA-2014:108)	Nessus	Mandriva Local Security Checks	medium
74329	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : gnutls (SSA:2014-156-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2014-3465

high

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium