gnutls did not properly verify x509 certificate chains. An attacker could exploit that to trick client programs into trusting servers that would normally get rejected (CVE-2008-4989).

The previous security fix for gnutls (CVE-2008-4989) introduced a regression in the X.509 validation code for self-signed certificates. 

This update fixes this problem.

USN-678-1 fixed a vulnerability in GnuTLS. The upstream patch introduced a regression when validating certain certificate chains that would report valid certificates as untrusted. This update fixes the problem.

We apologize for the inconvenience.

Martin von Gagern discovered that GnuTLS did not properly verify certificate chains when the last certificate in the chain was self-signed. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. (CVE-2008-4989).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2008:0982 :

Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).

Martin von Gagern discovered a flaw in the way GnuTLS verified certificate chains provided by a server. A malicious server could use this flaw to spoof its identity by tricking client applications using the GnuTLS library to trust invalid certificates. (CVE-2008-4989)

Users of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch that corrects this issue.

Moxie Marlinspike and Dan Kaminsky independently discovered that GnuTLS did not properly handle certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. (CVE-2009-2730)

Dan Kaminsky discovered GnuTLS would still accept certificates with MD2 hash signatures. As a result, an attacker could potentially create a malicious trusted certificate to impersonate another site. This issue only affected Ubuntu 6.06 LTS and Ubuntu 8.10. (CVE-2009-2409)

USN-678-1 fixed a vulnerability and USN-678-2 a regression in GnuTLS.
The upstream patches introduced a regression when validating certain certificate chains that would report valid certificates as untrusted.
This update fixes the problem, and only affected Ubuntu 6.06 LTS and Ubuntu 8.10 (Ubuntu 8.04 LTS and 9.04 were fixed at an earlier date).
In an effort to maintain a strong security stance and address all known regressions, this update deprecates X.509 validation chains using MD2 and MD5 signatures. To accomodate sites which must still use a deprected RSA-MD5 certificate, GnuTLS has been updated to stop looking when it has found a trusted intermediary certificate. This new handling of intermediary certificates is in accordance with other SSL implementations.

Martin von Gagern discovered that GnuTLS did not properly verify certificate chains when the last certificate in the chain was self-signed. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. (CVE-2008-4989).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS).

Martin von Gagern discovered a flaw in the way GnuTLS verified certificate chains provided by a server. A malicious server could use this flaw to spoof its identity by tricking client applications using the GnuTLS library to trust invalid certificates. (CVE-2008-4989)

Users of GnuTLS are advised to upgrade to these updated packages, which contain a backported patch that corrects this issue.

Martin von Gagern found a flow in how GnuTLS versions 1.2.4 up until 2.6.1 verified certificate chains provided by a server. A malicious server could use this flaw to spoof its identity by tricking client applications that used the GnuTLS library to trust invalid certificates (CVE-2008-4989).

Update :

It was found that the previously-published patch to correct this issue caused a regression when dealing with self-signed certificates. An updated patch that fixes the security issue and resolves the regression issue has been applied to these packages.

GNOME 2.6.0: GNU Transport Layer Security Library Patch.
Date this patch was last updated by Sun : Jun/04/09

GNOME 2.6.0_x86: GNU Transport Layer Security Library Patch.
Date this patch was last updated by Sun : Jun/04/09

GNOME 2.6.0_x86: GNU Transport Layer Security Library Patch.
Date this patch was last updated by Sun : Nov/15/14

gnutls did not properly verify x509 certificate chains. An attacker could exploit that to trick client programs into trusting servers that would normally get rejected. (CVE-2008-4989)

ID	名稱	產品	系列	已發布	已更新	嚴重性
35080	openSUSE 10 Security Update : gnutls (gnutls-5844)	Nessus	SuSE Local Security Checks	2008/12/10	2021/1/14	medium
36201	openSUSE 10 Security Update : gnutls (gnutls-6079)	Nessus	SuSE Local Security Checks	2009/4/21	2021/1/14	medium
37045	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : gnutls12, gnutls13, gnutls26 regression (USN-678-2)	Nessus	Ubuntu Local Security Checks	2009/4/23	2021/1/19	medium
39973	openSUSE Security Update : gnutls (gnutls-605)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
39972	openSUSE Security Update : gnutls (gnutls-358)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
67768	Oracle Linux 5 : gnutls (ELSA-2008-0982)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
40656	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : gnutls12, gnutls13, gnutls26 vulnerabilities (USN-809-1)	Nessus	Ubuntu Local Security Checks	2009/8/20	2021/1/19	high
43716	CentOS 5 : gnutls (CESA-2008:0982)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	medium
36960	Mandriva Linux Security Advisory : gnutls (MDVSA-2008:227-1)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	medium
107396	Solaris 10 (sparc) : 123938-02	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
107899	Solaris 10 (x86) : 123939-02	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
107901	Solaris 10 (x86) : 123939-04	Nessus	Solaris Local Security Checks	2018/3/12	2021/1/14	medium
41515	SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 5851)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium
40224	openSUSE Security Update : gnutls (gnutls-605)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	medium
41398	SuSE 11 Security Update : GnuTLS (SAT Patch Number 632)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium