PT-2008-6890 · Gnu+2 · Libgnutls13-Dbg+7

Published 1970-01-01 · Updated 2024-06-15 · CVE-2008-4989

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 2.6.1 gnutls-bin (affected versions not specified) gnutls-doc (affected versions not specified) libgnutls13 (affected versions not specified) libgnutls13-dbg (affected versions not specified) libgnutls-dev (affected versions not specified) Gentoo Linux gnutls versions prior to 2.4.1-r2

Description The issue is related to multiple vulnerabilities in the GnuTLS package, which can lead to a breach of protected information integrity. These vulnerabilities can be exploited remotely. Specifically, the gnutls x509 verify certificate function in lib/x509/verify.c in libgnutls trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, allowing man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Recommendations For GnuTLS versions prior to 2.6.1, update to version 2.6.1 or later to resolve the issue. For gnutls-bin, gnutls-doc, libgnutls13, libgnutls13-dbg, and libgnutls-dev, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Gentoo Linux gnutls versions prior to 2.4.1-r2, update to version 2.4.1-r2 or later to resolve the issue.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2015-01455

BDU:2015-01456

BDU:2015-01457

BDU:2015-01458

BDU:2015-01459

BDU:2015-09363

CVE-2008-4989

DSA-1719-1

OPENSUSE-SU-2024:10105-1

RHSA-2008:0982

RHSA-2008_0982

Affected Products

Gentoo Linux

Gnutls

Red Hat

Gnutls-Bin

Gnutls-Doc

Libgnutls-Dev

Libgnutls13

Libgnutls13-Dbg

References · 52

• http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html · Vendor Advisory
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215 · Patch
• http://security.gentoo.org/glsa/glsa-200901-10.xml · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-260528-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01457 · Security Note
• https://bdu.fstec.ru/vul/2015-01459 · Security Note
• http://securityfocus.com/bid/32232 · Patch
• https://bdu.fstec.ru/vul/2015-01455 · Security Note
• https://bdu.fstec.ru/vul/2015-09363 · Security Note
• http://ubuntu.com/usn/usn-678-2 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0982.html · Vendor Advisory
• https://usn.ubuntu.com/678-1 · Vendor Advisory
• http://debian.org/security/2009/dsa-1719 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-November/msg00293.html · Vendor Advisory