Detections
Analytics
Debian DLA-180-1 : gnutls26 security update
high Nessus Plugin ID 82166
Language:
Synopsis
The remote Debian host is missing a security update.Description
Multiple vulnerabilities have been discovered in GnuTLS, a library implementing the TLS and SSL protocols. The Common Vulnerabilities and Exposures project identifies the following problems :CVE-2014-8155
Missing date/time checks on CA certificates
CVE-2015-0282
GnuTLS does not verify the RSA PKCS #1 signature algorithm to match the signature algorithm in the certificate, leading to a potential downgrade to a disallowed algorithm without detecting it.
CVE-2015-0294
GnuTLS does not check whether the two signature algorithms match on certificate import.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected packages.See Also
https://lists.debian.org/debian-lts-announce/2015/03/msg00017.html
Plugin Details
Severity: High
ID: 82166
File Name: debian_DLA-180.nasl
Version: 1.9
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 3/26/2015
Updated: 1/11/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:gnutls-bin, p-cpe:/a:debian:debian_linux:gnutls-doc, p-cpe:/a:debian:debian_linux:guile-gnutls, p-cpe:/a:debian:debian_linux:libgnutls-dev, p-cpe:/a:debian:debian_linux:libgnutls26, p-cpe:/a:debian:debian_linux:libgnutls26-dbg, cpe:/o:debian:debian_linux:6.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 3/25/2015
Vulnerability Publication Date: 3/24/2015