bugtraq - [ MDVSA-2009:308 ] gnutls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1NGHML-00019y-3C@titan.mandriva.com>
Date: Thu, 03 Dec 2009 20:29:01 +0100
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2009:308 ] gnutls

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:308
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : gnutls
 Date    : December 3, 2009
 Affected: 2008.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in gnutls:

 gnutls-cli in GnuTLS before 2.6.6 does not verify the activation
 and expiration times of X.509 certificates, which allows remote
 attackers to successfully present a certificate that is (1) not yet
 valid or (2) no longer valid, related to lack of time checks in the
 _gnutls_x509_verify_certificate function in lib/x509/verify.c in
 libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup
 (CVE-2009-1417).

 A vulnerability have been discovered and corrected in GnuTLS
 before 2.8.2, which could allow man-in-the-middle attackers to spoof
 arbitrary SSL servers via a crafted certificate issued by a legitimate
 Certification Authority (CVE-2009-2730).

 Packages for 2008.0 are being provided due to extended support for
 Corporate products.

 This update fixes this vulnerability.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2730
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 b0476297b05fee1e5379a8826905757f  2008.0/i586/gnutls-2.0.0-2.4mdv2008.0.i586.rpm
 31f117592b8dcb5c3b80b8fde7d2cf2b  2008.0/i586/libgnutls13-2.0.0-2.4mdv2008.0.i586.rpm
 f9580a96c2b938a67ffc821b4536ce05  2008.0/i586/libgnutls-devel-2.0.0-2.4mdv2008.0.i586.rpm 
 2d4a130600be226d1ace20f6de574edb  2008.0/SRPMS/gnutls-2.0.0-2.4mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 c36eb24563dc027a84aee5f7b4e0e792  2008.0/x86_64/gnutls-2.0.0-2.4mdv2008.0.x86_64.rpm
 3e58a09629aac586a5f1697063d04421  2008.0/x86_64/lib64gnutls13-2.0.0-2.4mdv2008.0.x86_64.rpm
 58fbcf88685697a5a2a7959fbd84420d  2008.0/x86_64/lib64gnutls-devel-2.0.0-2.4mdv2008.0.x86_64.rpm 
 2d4a130600be226d1ace20f6de574edb  2008.0/SRPMS/gnutls-2.0.0-2.4mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLF+Y3mqjQ0CJFipgRAjwhAJ4qfWW60ocYAHhKFR2tnFdvyjUqNQCeO+K2
DJynsXMpzvrD4rEBCyT14Io=
=3onS
-----END PGP SIGNATURE-----