|Category:||Ubuntu Local Security Checks|
|Title:||Ubuntu USN-126-1 (gnutls10)|
The remote host is missing an update to gnutls10
announced via advisory USN-126-1.
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected:
A Denial of Service vulnerability was discovered in the GNU TLS
library, which provides common cryptographic algorithms and is used by
many applications in Ubuntu. Due to a missing sanity check of the
padding length field, specially crafted ciphertext blocks caused an
out of bounds memory access which could crash the application. It was
not possible to exploit this to execute any attacker specified code.
The problem can be corrected by upgrading the affected package to
version 1.0.4-3ubuntu1.1 (for Ubuntu 4.10), or 1.0.16-13ubuntu0.1 (for
Ubuntu 5.04). For most desktop applications, a standard system
upgrade is sufficient to effect the necessary changes. However, if you
are using server and long running applications that use libgnutls
(cupsys, exim4, Gaim), you must restart them manually. If you can
afford to reboot your machine, this is the easiest way to ensure that
all services using this library are restarted correctly.
Risk factor : Medium
Common Vulnerability Exposure (CVE) ID: CVE-2005-1431|
BugTraq ID: 13477
XForce ISS Database: gnutls-record-parsing-dos(20328)
|Copyright||Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com|
|This is only one of 69903 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.