ID de Prueba:	1.3.6.1.4.1.25623.1.0.871850
Categoría:	Red Hat Local Security Checks
Título:	RedHat Update for gnutls RHSA-2017:2292-01
Resumen:	The remote host is missing an update for the 'gnutls'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'gnutls' package(s) announced via the referenced advisory. Vulnerability Insight: The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. The following packages have been upgraded to a later upstream version: gnutls (3.3.26). (BZ#1378373) Security Fix(es): * A double-free flaw was found in the way GnuTLS parsed certain X.509 certificates with Proxy Certificate Information extension. An attacker could create a specially-crafted certificate which, when processed by an application compiled against GnuTLS, could cause that application to crash. (CVE-2017-5334) * Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337, CVE-2017-7869) * A null pointer dereference flaw was found in the way GnuTLS processed ClientHello messages with status_request extension. A remote attacker could use this flaw to cause an application compiled with GnuTLS to crash. (CVE-2017-7507) * A flaw was found in the way GnuTLS validated certificates using OCSP responses. This could falsely report a certificate as valid under certain circumstances. (CVE-2016-7444) The CVE-2017-7507 issue was discovered by Hubert Kario (Red Hat QE BaseOS Security team). Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section. Affected Software/OS: gnutls on Red Hat Enterprise Linux Server (v. 7) Solution: Please Install the Updated Packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7444 BugTraq ID: 92893 http://www.securityfocus.com/bid/92893 https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html RedHat Security Advisories: RHSA-2017:2292 https://access.redhat.com/errata/RHSA-2017:2292 SuSE Security Announcement: openSUSE-SU-2017:0386 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html Common Vulnerability Exposure (CVE) ID: CVE-2017-5334 BugTraq ID: 95370 http://www.securityfocus.com/bid/95370 https://security.gentoo.org/glsa/201702-04 http://www.openwall.com/lists/oss-security/2017/01/10/7 http://www.openwall.com/lists/oss-security/2017/01/11/4 http://www.securitytracker.com/id/1037576 Common Vulnerability Exposure (CVE) ID: CVE-2017-5335 BugTraq ID: 95374 http://www.securityfocus.com/bid/95374 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=337 RedHat Security Advisories: RHSA-2017:0574 http://rhn.redhat.com/errata/RHSA-2017-0574.html Common Vulnerability Exposure (CVE) ID: CVE-2017-5336 BugTraq ID: 95377 http://www.securityfocus.com/bid/95377 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340 Common Vulnerability Exposure (CVE) ID: CVE-2017-5337 BugTraq ID: 95372 http://www.securityfocus.com/bid/95372 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346 Common Vulnerability Exposure (CVE) ID: CVE-2017-7507 99102 http://www.securityfocus.com/bid/99102 DSA-3884 http://www.debian.org/security/2017/dsa-3884 RHSA-2017:2292 https://www.gnutls.org/security.html#GNUTLS-SA-2017-4 Common Vulnerability Exposure (CVE) ID: CVE-2017-7869 BugTraq ID: 97040 http://www.securityfocus.com/bid/97040 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420 https://gitlab.com/gnutls/gnutls/commit/51464af713d71802e3c6d5ac15f1a95132a354fe
Copyright	Copyright (C) 2017 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.