BugTraq
[ MDVSA-2014:048 ] gnutls Mar 10 2014 01:01PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:048
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : gnutls
Date : March 10, 2014
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Updated gnutls packages fix security vulnerability:

It was discovered that GnuTLS did not correctly handle certain errors
that could occur during the verification of an X.509 certificate,
causing it to incorrectly report a successful verification. An attacker
could use this flaw to create a specially crafted certificate that
could be accepted by GnuTLS as valid for a site chosen by the attacker
(CVE-2014-0092).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092
http://advisories.mageia.org/MGASA-2014-0117.html
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
102f795d8475e9c9d6df72aeffd9213b mes5/i586/gnutls-2.4.1-2.10mdvmes5.2.i586.rpm
1f87f8bce0222e4bad7f098e9ae04467 mes5/i586/libgnutls26-2.4.1-2.10mdvmes5.2.i586.rpm
c9bffc45aaddf198ccf185d130cd06c6 mes5/i586/libgnutls-devel-2.4.1-2.10mdvmes5.2.i586.rpm
c713dc5b541177d7ad289853a6be2869 mes5/SRPMS/gnutls-2.4.1-2.10mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
74cf2ef8f62b6695fb7e0302bbd05f21 mes5/x86_64/gnutls-2.4.1-2.10mdvmes5.2.x86_64.rpm
1c915d2bfcadb6cb85ee2a80a3adf6ce mes5/x86_64/lib64gnutls26-2.4.1-2.10mdvmes5.2.x86_64.rpm
62d52e05b82032c7952f2dbf8e60482f mes5/x86_64/lib64gnutls-devel-2.4.1-2.10mdvmes5.2.x86_64.rpm
c713dc5b541177d7ad289853a6be2869 mes5/SRPMS/gnutls-2.4.1-2.10mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
53bb1704d26e27aeeeddfdcf093c28a3 mbs1/x86_64/gnutls-3.0.28-1.2.mbs1.x86_64.rpm
9d87ba4210c47fd889e311cfddcbc0eb mbs1/x86_64/lib64gnutls28-3.0.28-1.2.mbs1.x86_64.rpm
3055076fd43b6a23e8ca36ca898e2378 mbs1/x86_64/lib64gnutls-devel-3.0.28-1.2.mbs1.x86_64.rpm
6c7adf3386ec46df821457f8ed0962f0 mbs1/x86_64/lib64gnutls-ssl27-3.0.28-1.2.mbs1.x86_64.rpm
2399c9cd4b3b4eb1cd1ad82a2dbbc90e mbs1/SRPMS/gnutls-3.0.28-1.2.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTHYuPmqjQ0CJFipgRAnO5AJ9UPgEWklfcapkAlRUrevDFRY5w1QCfUwqw
BPc793TFRj1+Ic7Ckur6Ahs=
=EexV
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus