PT-2009-1089 · Gnu · Gnutls

Romain Francoise · Published 2009-04-30 · Updated 2017-08-17 · CVE-2009-1417

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 2.6.6

Description The issue affects the gnutls package in Gentoo Linux, allowing remote attackers to exploit multiple vulnerabilities and compromise the confidentiality, integrity, and availability of protected information. Specifically, gnutls-cli in GnuTLS does not verify the activation and expiration times of X.509 certificates, enabling attackers to present invalid or expired certificates. This is related to the lack of time checks in the gnutls x509 verify certificate function.

Recommendations For versions prior to 2.6.6, update to version 2.6.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the gnutls x509 verify certificate function until a patch is available. Additionally, ensure proper verification of X.509 certificate activation and expiration times to minimize the risk of exploitation.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-310

CWE-824

Related Identifiers

BDU:2015-09391

CVE-2009-1417

Affected Products

Gnutls

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2009-1417 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2009:116 · Vendor Advisory
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 · Patch
• https://bdu.fstec.ru/vul/2015-09391 · Security Note
• http://security.gentoo.org/glsa/glsa-200905-04.xml · Vendor Advisory
• http://secunia.com/advisories/34842 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1218 · Note
• http://securitytracker.com/id?1022159 · Note
• http://securityfocus.com/bid/34783 · Note
• http://secunia.com/advisories/35211 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50261 · Note