Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long DistinguishedName (DN) entry in a certificate.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gnutls: certificate algorithm consistency checking issue (CVE-2015-0294)

  - gnutls: use-after-free flaw in CRL distribution points parsing (CVE-2015-3308)

  - Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause     a denial of service via a long DistinguishedName (DN) entry in a certificate. (CVE-2015-6251)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

New gnutls packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix a security issue.

gnutls was updated to fix several security vulnerabilities.

  - fix double free in certificate DN decoding     (GNUTLS-SA-2015-3)(bsc#941794,CVE-2015-6251)

  - fix invalid read in octet string in bundled libtasn1     (bsc#929414,CVE-2015-3622)

  - fix ServerKeyExchange signature issue     (GNUTLS-SA-2015-2)(bsc#929690)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gnutls was updated to fix one security issue.

The following vulnerability was fixed :

  - CVE-2015-6251: Decoding specific certificates with very     long DistinguishedName (DN) entries could have caused a     double free, which may have resulted in a Denial of     Service (GNUTLS-SA-2015-3)

It was discovered that GnuTLS incorrectly handled parsing CRL distribution points. A remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code.
(CVE-2015-3308)

Kurt Roeckx discovered that GnuTLS incorrectly handled a long DistinguishedName (DN) entry in a certificate. A remote attacker could possibly use this issue to cause a denial of service, or execute arbitrary code. (CVE-2015-6251).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

new upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New gnutls packages are available for Slackware 14.0, 14.1, and
-current to fix security issues. IMPORTANT: On Slackware 14.0, install the new updated nettle package first.

gnutls.org reports :

Kurt Roeckx reported that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free, which may result to a denial of service. Since the DN decoding occurs in almost all applications using certificates it is recommended to upgrade the latest GnuTLS version fixing the issue. Recommendation: Upgrade to GnuTLS 3.4.4, or 3.3.17.

Kurt Roeckx discovered that decoding a specific certificate with very long DistinguishedName (DN) entries leads to double free. A remote attacker can take advantage of this flaw by creating a specially crafted certificate that, when processed by an application compiled against GnuTLS, could cause the application to crash resulting in a denial of service.

ID	Name	Product	Family	Severity
198359	RHEL 7 : gnutls (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
93411	Slackware 14.0 / 14.1 / 14.2 / current : gnutls (SSA:2016-254-01)	Nessus	Slackware Local Security Checks	medium
85901	SUSE SLED12 / SLES12 Security Update : gnutls (SUSE-SU-2015:1518-1)	Nessus	SuSE Local Security Checks	medium
85836	openSUSE Security Update : gnutls (openSUSE-2015-567)	Nessus	SuSE Local Security Checks	medium
85735	Ubuntu 15.04 : gnutls28 vulnerabilities (USN-2727-1)	Nessus	Ubuntu Local Security Checks	high
85709	Fedora 23 : gnutls-3.4.4-1.fc23 (2015-13287)	Nessus	Fedora Local Security Checks	medium
85583	Slackware 14.0 / 14.1 / current : gnutls (SSA:2015-233-01)	Nessus	Slackware Local Security Checks	medium
85429	FreeBSD : gnutls -- double free in certificate DN decoding (ec6a2a1e-429d-11e5-9daa-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	medium
85357	Debian DSA-3334-1 : gnutls28 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-6251

high

Tenable Plugins

high

medium

medium

medium

high

medium

medium

medium

medium