The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0247 advisory.

    - fix issues of CVE-2014-0092 (#1069888)
    - fix CVE-2013-2116 - fix DoS regression in CVE-2013-1619       upstream patch (#966754)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1     X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by     leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability     than CVE-2014-1959. (CVE-2009-5138)

Note that Nessus relies on the presence of the package as reported by the vendor.

The GnuTLS library received a critical security fix and other updates :

  - CVE-2014-0092: The X.509 certificate verification had     incorrect error handling, which could lead to broken     certificates marked as being valid.

  - CVE-2009-5138: A verification problem in handling V1     certificates could also lead to V1 certificates     incorrectly being handled.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092)

A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid. (CVE-2009-5138)

For the update to take effect, all applications linked to the GnuTLS library must be restarted.

Updated gnutls packages that fix two security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).

It was discovered that GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification. An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid for a site chosen by the attacker. (CVE-2014-0092)

A flaw was found in the way GnuTLS handled version 1 X.509 certificates. An attacker able to obtain a version 1 certificate from a trusted certificate authority could use this flaw to issue certificates for other sites that would be accepted by GnuTLS as valid. (CVE-2009-5138)

The CVE-2014-0092 issue was discovered by Nikos Mavrogiannopoulos of the Red Hat Security Technologies Team.

Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS library must be restarted.

The GnuTLS library received a critical security fix and other updates :

  - The X.509 certificate verification had incorrect error     handling, which could lead to broken certificates marked     as being valid. (CVE-2014-0092)

  - A verification problem in handling V1 certificates could     also lead to V1 certificates incorrectly being handled.
    Additionally a memory leak in PSK authentication has     been fixed. (bnc#835760). (CVE-2009-5138)

ID	Name	Product	Family	Published	Updated	Severity
72792	Oracle Linux 5 : gnutls (ELSA-2014-0247)	Nessus	Oracle Linux Local Security Checks	3/4/2014	10/22/2024	high
217142	Linux Distros Unpatched Vulnerability : CVE-2009-5138	Nessus	Misc.	3/3/2025	3/3/2025	high
83612	SUSE SLES10 Security Update : gnutls (SUSE-SU-2014:0321-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/19/2021	medium
72795	Scientific Linux Security Update : gnutls on SL5.x i386/x86_64 (20140303)	Nessus	Scientific Linux Local Security Checks	3/4/2014	1/14/2021	medium
72794	RHEL 5 : gnutls (RHSA-2014:0247)	Nessus	Red Hat Local Security Checks	3/4/2014	1/14/2021	medium
72797	SuSE 11.3 Security Update : gnutls (SAT Patch Number 8949)	Nessus	SuSE Local Security Checks	3/4/2014	1/19/2021	medium
72804	CentOS 5 : gnutls (CESA-2014:0247)	Nessus	CentOS Local Security Checks	3/5/2014	1/4/2021	medium

Detections

Analytics

Plugins Search

high

high

medium

medium

medium

medium

medium