drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in gnutls
Name: |
Zwei Probleme in gnutls |
|
ID: |
MDVSA-2009:308 |
|
Distribution: |
Mandriva |
|
Plattformen: |
Mandriva 2008.0 |
|
Datum: |
Do, 3. Dezember 2009, 20:30 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2730 |
|
Applikationen: |
GNU Transport Layer Security Library |
|
Originalnachricht |
This is a multi-part message in MIME format...
------------=_1259868630-24326-1562
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:308 http://www.mandriva.com/security/ _______________________________________________________________________
Package : gnutls Date : December 3, 2009 Affected: 2008.0 _______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been found and corrected in gnutls: gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup (CVE-2009-1417). A vulnerability have been discovered and corrected in GnuTLS before 2.8.2, which could allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority (CVE-2009-2730). Packages for 2008.0 are being provided due to extended support for Corporate products. This update fixes this vulnerability. _______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1417 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2730 _______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0: b0476297b05fee1e5379a8826905757f 2008.0/i586/gnutls-2.0.0-2.4mdv2008.0.i586.rpm 31f117592b8dcb5c3b80b8fde7d2cf2b 2008.0/i586/libgnutls13-2.0.0-2.4mdv2008.0.i586.rpm f9580a96c2b938a67ffc821b4536ce05 2008.0/i586/libgnutls-devel-2.0.0-2.4mdv2008.0.i586.rpm 2d4a130600be226d1ace20f6de574edb 2008.0/SRPMS/gnutls-2.0.0-2.4mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64: c36eb24563dc027a84aee5f7b4e0e792 2008.0/x86_64/gnutls-2.0.0-2.4mdv2008.0.x86_64.rpm 3e58a09629aac586a5f1697063d04421 2008.0/x86_64/lib64gnutls13-2.0.0-2.4mdv2008.0.x86_64.rpm 58fbcf88685697a5a2a7959fbd84420d 2008.0/x86_64/lib64gnutls-devel-2.0.0-2.4mdv2008.0.x86_64.rpm 2d4a130600be226d1ace20f6de574edb 2008.0/SRPMS/gnutls-2.0.0-2.4mdv2008.0.src.rpm _______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com _______________________________________________________________________
Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFLF+Y3mqjQ0CJFipgRAjwhAJ4qfWW60ocYAHhKFR2tnFdvyjUqNQCeO+K2 DJynsXMpzvrD4rEBCyT14Io= =3onS -----END PGP SIGNATURE-----
------------=_1259868630-24326-1562 Content-Type: text/plain; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit
To unsubscribe, send a email to sympa@mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________
------------=_1259868630-24326-1562--
|
|
|
|