ID de Prueba:	1.3.6.1.4.1.25623.1.0.882080
Categoría:	CentOS Local Security Checks
Título:	CentOS Update for gnutls CESA-2014:1846 centos7
Resumen:	Check the version of gnutls
Descripción:	Summary: Check the version of gnutls Vulnerability Insight: The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). The gnutls packages also include the libtasn1 library, which provides Abstract Syntax Notation One (ASN.1) parsing and structures management, and Distinguished Encoding Rules (DER) encoding and decoding functions. An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR). A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application. (CVE-2014-8564) Red Hat would like to thank GnuTLS upstream for reporting this issue. Upstream acknowledges Sean Burford as the original reporter. All gnutls users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. For the update to take effect, all applications linked to the GnuTLS or libtasn1 library must be restarted. Affected Software/OS: gnutls on CentOS 7 Solution: Please install the updated packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-8564 RedHat Security Advisories: RHSA-2014:1846 http://rhn.redhat.com/errata/RHSA-2014-1846.html http://secunia.com/advisories/59991 http://secunia.com/advisories/62284 http://secunia.com/advisories/62294 SuSE Security Announcement: openSUSE-SU-2014:1472 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-11/msg00084.html http://www.ubuntu.com/usn/USN-2403-1
Copyright	Copyright (C) 2014 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.