PT-2014-1865 · Gnu+4 · Gnutls+4

Publicado 2014-03-03 · Atualizado 2024-06-15 · CVE-2014-0092

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.1.22 GnuTLS versions 3.2.x prior to 3.2.12

Description The issue arises from improper handling of unspecified errors when verifying X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers via a crafted certificate. Exploitation of this vulnerability can lead to a breach of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For GnuTLS versions prior to 3.1.22, update to version 3.1.22 or later. For GnuTLS versions 3.2.x prior to 3.2.12, update to version 3.2.12 or later. As a temporary workaround, consider restricting the use of X.509 certificate verification until a patch is available.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

ALT-PU-2014-1263

BDU:2015-07241

BDU:2015-07246

BDU:2015-07249

BDU:2015-07253

BDU:2015-09761

CESA-2014_0246

CVE-2014-0092

DSA-2869-1

MGASA-2014-0117

OPENSUSE-SU-2014_0325-1

OPENSUSE-SU-2014_0328-1

OPENSUSE-SU-2014_0346-1

OPENSUSE-SU-2024:10105-1

RHSA-2014:0246

RHSA-2014:0247

RHSA-2014:0288

RHSA-2014:0339

RHSA-2014_0246

RHSA-2014_0247

SUSE-SU-2014_0321-1

SUSE-SU-2014_0323-1

SUSE-SU-2015:0675-1

USN-2127-1

Produtos afetados

Alt Linux

Centos

Gnutls

Red Hat

Suse

Referências · 89

• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00004.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3466 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0092 · Aviso do Fabricante
• http://secunia.com/advisories/57103 · Nota
• https://ubuntu.com/security/CVE-2014-0092 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-6251 · Nota
• http://debian.org/security/2014/dsa-2869 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-1959 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0092 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2012-1569 · Nota
• http://download.novell.com/patch/finder/?keywords=b548d1e9d587491bc78588fee9939590 · Nota
• http://secunia.com/advisories/57204 · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2014-March/069660.html · Nota
• https://access.redhat.com/errata/RHSA-2014:0247 · Nota