Attachment 91505 Details for Bug 128868 – vuln.xml

vuln.xml

vuln.xml (text/plain), 2.17 KB, created by Eygene Ryabinkin on 2008-11-14 15:00:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eygene Ryabinkin

Created: 2008-11-14 15:00:10 UTC

Size: 2.17 KB

patch

obsolete

> <vuln vid="">
> <topic>GnuTLS -- X.509 certificate chain validation vulnerability</topic>
> <affects>
> <package>
>	<name>gnutls</name>
>	<range><gt>2.4.0</gt><lt>2.4.2</lt></range>
> </package>
> <package>
>	<name>gnutls</name>
>	<range><gt>2.6.0</gt><lt>2.6.1</lt></range>
> </package>
> </affects>
> <description>
> <body xmlns="http://www.w3.org/1999/xhtml">
>	Martin von Gagern reports:
>	<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217">
>	 This is an analysis fo the GNU TLS vulnerability
>	 recently published as GNUTLS-SA-2008-3 and CVE-2008-4989.
>
>	 I found a bug in GNU TLS which breaks X.509 certificate
>	 chain verification. This allows a man in the middle to assume
>	 any name and trick GNU TLS clients into trusting that name.
>
>	 This could be used to imitate a server using a specially
>	 crafted server certificate chain together with DNS spoofing or
>	 some way of intercepting packets along their route. It could
>	 also be used to imitate clients authenticating to some service
>	 using client certificates, again using specially crafted
>	 certificate chains.
>	</blockquote>
>	Announcement of GnuTLS 2.6.1:
>	<blockquote cite="http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215">
>	 Version 2.6.1 is a maintainance and security release
>	 on our stable branch.
>
>	 ** libgnutls: Fix X.509 certificate chain validation error.
>	 [GNUTLS-SA-2008-3]
>
>	 The flaw makes it possible for man in the middle attackers
>	 (i.e., active attackers) to assume any name and trick GNU TLS
>	 clients into trusting that name. Thanks for report and
>	 analysis from Martin von Gagern &lt;Martin.vGagern &lt;at&gt;
>	 gmx.net&gt;. [CVE-2008-4989]
>	</blockquote>
> </body>
> </description>
> <references>
> <cvename>CVE-2008-4989</cvename>
> <url>http://www.gnu.org/software/gnutls/security.html</url>
> <url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217</url>
> <url>http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3215</url>
> </references>
> <dates>
> <discovery>2008-11-10</discovery>
> </dates>
> </vuln>

Actions: View

Attachments on bug 128868: 91505 | 91506 | 91507