The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0247 advisory.

    - fix issues of CVE-2014-0092 (#1069888)
    - fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619       upstream patch (#966754)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092)

A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid. (CVE-2009-5138)

For the update to take effect, all applications linked to the GnuTLS library must be restarted.

The GnuTLS library received a critical security fix and other updates :

  - CVE-2014-0092: The X.509 certificate verification had     incorrect error handling, which could lead to broken     certificates marked as being valid.

  - CVE-2009-5138: A verification problem in handling V1     certificates could also lead to V1 certificates     incorrectly being handled.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gnutls: incorrect handling of V1 intermediate certificates (CVE-2009-5138)

  - gnutls: incorrect error handling in certificate verification (GNUTLS-SA-2014-2) (CVE-2014-0092)

  - Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before     2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows     remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.
    (CVE-2011-4128)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092)

A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid. (CVE-2009-5138)

The CVE-2014-0092 issue was discovered by Nikos Mavrogiannopoulos of the Red Hat Security Technologies Team.

Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS library must be restarted.

The GnuTLS library received a critical security fix and other updates :

  - The X.509 certificate verification had incorrect error     handling, which could lead to broken certificates marked     as being valid. (CVE-2014-0092)

  - A verification problem in handling V1 certificates could     also lead to V1 certificates incorrectly being handled.
    Additionally a memory leak in PSK authentication has     been fixed. (bnc#835760). (CVE-2009-5138)

ID	Name	Product	Family	Published	Updated	Severity
72792	Oracle Linux 5 : gnutls (ELSA-2014-0247)	Nessus	Oracle Linux Local Security Checks	3/4/2014	10/22/2024	high
72795	Scientific Linux Security Update : gnutls on SL5.x i386/x86_64 (20140303)	Nessus	Scientific Linux Local Security Checks	3/4/2014	1/14/2021	medium
83612	SUSE SLES10 Security Update : gnutls (SUSE-SU-2014:0321-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/19/2021	medium
198544	RHEL 6 : mingw32-gnutls (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
72794	RHEL 5 : gnutls (RHSA-2014:0247)	Nessus	Red Hat Local Security Checks	3/4/2014	1/14/2021	medium
72804	CentOS 5 : gnutls (CESA-2014:0247)	Nessus	CentOS Local Security Checks	3/5/2014	1/4/2021	medium
72797	SuSE 11.3 Security Update : gnutls (SAT Patch Number 8949)	Nessus	SuSE Local Security Checks	3/4/2014	1/19/2021	medium

Detections

Analytics

Plugins Search

high

medium

medium

high

medium

medium

medium