Test ID:	1.3.6.1.4.1.25623.1.0.64129
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDVSA-2009:116 (gnutls)
Summary:	The remote host is missing an update to gnutls;announced via advisory MDVSA-2009:116.
Description:	Summary: The remote host is missing an update to gnutls announced via advisory MDVSA-2009:116. Vulnerability Insight: Multiple vulnerabilities has been found and corrected in gnutls: lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free (CVE-2009-1415). lib/gnutls_pk.c in libgnutls in GnuTLS 2.5.0 through 2.6.5 generates RSA keys stored in DSA structures, instead of the intended DSA keys, which might allow remote attackers to spoof signatures on certificates or have unspecified other impact by leveraging an invalid DSA key (CVE-2009-1416). gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup (CVE-2009-1417). The updated packages have been patched to prevent this. Affected: 2008.1, 2009.0, 2009.1, Corporate 4.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-1415 BugTraq ID: 34783 http://www.securityfocus.com/bid/34783 http://security.gentoo.org/glsa/glsa-200905-04.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:116 http://permalink.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3502 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515 http://www.securitytracker.com/id?1022157 http://secunia.com/advisories/34842 http://secunia.com/advisories/35211 http://www.vupen.com/english/advisories/2009/1218 XForce ISS Database: gnutls-dsa-code-execution(50257) https://exchange.xforce.ibmcloud.com/vulnerabilities/50257 XForce ISS Database: gnutls-dsa-dos(50260) https://exchange.xforce.ibmcloud.com/vulnerabilities/50260 XForce ISS Database: gnutls-libgnutls-dos(50445) https://exchange.xforce.ibmcloud.com/vulnerabilities/50445 Common Vulnerability Exposure (CVE) ID: CVE-2009-1416 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516 http://lists.gnu.org/archive/html/help-gnutls/2009-04/msg00018.html http://www.securitytracker.com/id?1022158 Common Vulnerability Exposure (CVE) ID: CVE-2009-1417 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517 http://www.securitytracker.com/id?1022159 XForce ISS Database: gnutls-gnutlscli-spoofing(50261) https://exchange.xforce.ibmcloud.com/vulnerabilities/50261
Copyright	Copyright (C) 2009 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.