March 2014 - openSUSE Security Announce

[security-announce] openSUSE-SU-2014:0325-1: critical: gnutls: fixed SSL certificate validation problems
by opensuse-security＠opensuse.org 05 Mar '14

05 Mar '14

openSUSE Security Update: gnutls: fixed SSL certificate validation problems ______________________________________________________________________________ Announcement ID: openSUSE-SU-2014:0325-1 Rating: critical References: #865804 Cross-References: CVE-2014-0092 Affected Products: openSUSE 13.1 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The gnutls library was updated to fixed x509 certificate validation problems, where man-in-the-middle attackers could hijack SSL connections. This update also reenables Elliptic Curve support to meet current day cryptographic requirements. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 13.1: zypper in -t patch openSUSE-2014-181 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 13.1 (i586 x86_64): gnutls-3.2.4-2.14.1 gnutls-debuginfo-3.2.4-2.14.1 gnutls-debugsource-3.2.4-2.14.1 libgnutls-devel-3.2.4-2.14.1 libgnutls-openssl-devel-3.2.4-2.14.1 libgnutls-openssl27-3.2.4-2.14.1 libgnutls-openssl27-debuginfo-3.2.4-2.14.1 libgnutls28-3.2.4-2.14.1 libgnutls28-debuginfo-3.2.4-2.14.1 libgnutlsxx-devel-3.2.4-2.14.1 libgnutlsxx28-3.2.4-2.14.1 libgnutlsxx28-debuginfo-3.2.4-2.14.1 - openSUSE 13.1 (x86_64): libgnutls-devel-32bit-3.2.4-2.14.1 libgnutls28-32bit-3.2.4-2.14.1 libgnutls28-debuginfo-32bit-3.2.4-2.14.1 References: http://support.novell.com/security/cve/CVE-2014-0092.html https://bugzilla.novell.com/865804 -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0324-1: critical: Security update for gnutls
by opensuse-security＠opensuse.org 04 Mar '14

04 Mar '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0324-1 Rating: critical References: #865804 Cross-References: CVE-2014-0092 Affected Products: SUSE CORE 9 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: The GnuTLS library received a critical security fix: * CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. Security Issue reference: * CVE-2014-0092 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092 > Package List: - SUSE CORE 9 (i586 s390 s390x x86_64): gnutls-1.0.8-26.30 gnutls-devel-1.0.8-26.30 References: http://support.novell.com/security/cve/CVE-2014-0092.html https://bugzilla.novell.com/865804 http://download.novell.com/patch/finder/?keywords=f0ade0f71a1461cdf632f9425… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0323-1: critical: Security update for gnutls
by opensuse-security＠opensuse.org 04 Mar '14

04 Mar '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0323-1 Rating: critical References: #835760 #865804 #865993 Cross-References: CVE-2014-0092 Affected Products: SUSE Linux Enterprise Server 11 SP2 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has two fixes is now available. Description: The GnuTLS library received a critical security fix and other updates: * CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. * CVE-2009-5138: A verification problem in handling V1 certificates could also lead to V1 certificates incorrectly being handled. Additionally, a memory leak in PSK authentication was fixed. bnc#835760 Security Issues: * CVE-2014-0092 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP2 LTSS: zypper in -t patch slessp2-gnutls-8950 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64): gnutls-2.4.1-24.39.49.1 libgnutls-extra26-2.4.1-24.39.49.1 libgnutls26-2.4.1-24.39.49.1 - SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64): libgnutls26-32bit-2.4.1-24.39.49.1 References: http://support.novell.com/security/cve/CVE-2014-0092.html https://bugzilla.novell.com/835760 https://bugzilla.novell.com/865804 https://bugzilla.novell.com/865993 http://download.novell.com/patch/finder/?keywords=b548d1e9d587491bc78588fee… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0322-1: critical: Security update for gnutls
by opensuse-security＠opensuse.org 04 Mar '14

04 Mar '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0322-1 Rating: critical References: #760265 #802651 #821818 #835760 #865804 #865993 Cross-References: CVE-2009-5138 CVE-2013-1619 CVE-2013-2116 CVE-2014-0092 Affected Products: SUSE Linux Enterprise Server 11 SP1 LTSS ______________________________________________________________________________ An update that solves four vulnerabilities and has two fixes is now available. Description: The GnuTLS library received a critical security fix and other updates: * CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. * CVE-2009-5138: A verification problem in handling V1 certificates could also lead to V1 certificates incorrectly being handled. * CVE-2013-2116: The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS allowed remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. * CVE-2013-1619: Timing attacks against hashing of padding was fixed which might have allowed disclosure of keys. (Lucky13 attack). Also the following non-security bugs have been fixed: * gnutls doesn't like root CAs without Basic Constraints. Permit V1 Certificate Authorities properly (bnc#760265) * memory leak in PSK authentication (bnc#835760) Security Issue references: * CVE-2014-0092 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092 > * CVE-2009-5138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5138 > * CVE-2013-2116 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2116 > * CVE-2013-1619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11 SP1 LTSS: zypper in -t patch slessp1-gnutls-8951 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64): gnutls-2.4.1-24.39.49.1 libgnutls-extra26-2.4.1-24.39.49.1 libgnutls26-2.4.1-24.39.49.1 - SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64): libgnutls26-32bit-2.4.1-24.39.49.1 References: http://support.novell.com/security/cve/CVE-2009-5138.html http://support.novell.com/security/cve/CVE-2013-1619.html http://support.novell.com/security/cve/CVE-2013-2116.html http://support.novell.com/security/cve/CVE-2014-0092.html https://bugzilla.novell.com/760265 https://bugzilla.novell.com/802651 https://bugzilla.novell.com/821818 https://bugzilla.novell.com/835760 https://bugzilla.novell.com/865804 https://bugzilla.novell.com/865993 http://download.novell.com/patch/finder/?keywords=356cafe0671e679ac89f61fb7… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0321-1: critical: Security update for gnutls
by opensuse-security＠opensuse.org 04 Mar '14

04 Mar '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0321-1 Rating: critical References: #865804 #865993 Cross-References: CVE-2014-0092 Affected Products: SUSE Linux Enterprise Server 10 SP4 LTSS ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: The GnuTLS library received a critical security fix and other updates: * CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. * CVE-2009-5138: A verification problem in handling V1 certificates could also lead to V1 certificates incorrectly being handled. Security Issue references: * CVE-2014-0092 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092 > Package List: - SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64): gnutls-1.2.10-13.38.1 gnutls-devel-1.2.10-13.38.1 - SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64): gnutls-32bit-1.2.10-13.38.1 gnutls-devel-32bit-1.2.10-13.38.1 References: http://support.novell.com/security/cve/CVE-2014-0092.html https://bugzilla.novell.com/865804 https://bugzilla.novell.com/865993 http://download.novell.com/patch/finder/?keywords=37d0e9642492b343b6f431f0f… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0320-1: critical: Security update for gnutls
by opensuse-security＠opensuse.org 04 Mar '14

04 Mar '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0320-1 Rating: critical References: #536809 #554084 #659128 #739898 #753301 #754223 #802651 #821818 #865804 #865993 Cross-References: CVE-2009-5138 CVE-2011-4108 CVE-2012-0390 CVE-2012-1569 CVE-2012-1573 CVE-2013-0169 CVE-2013-1619 CVE-2013-2116 CVE-2014-0092 Affected Products: SUSE Linux Enterprise Server 10 SP3 LTSS ______________________________________________________________________________ An update that solves 9 vulnerabilities and has one errata is now available. Description: The GnuTLS library received a critical security fix and other updates: * CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. * CVE-2009-5138: A verification problem in handling V1 certificates could also lead to V1 certificates incorrectly being handled. * CVE-2013-2116: The _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in GnuTLS allowed remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. * CVE-2013-1619: The TLS implementation in GnuTLS did not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. (Lucky13) * CVE-2012-1569: The asn1_get_length_der function in decoding.c in GNU Libtasn1 , as used in GnuTLS did not properly handle certain large length values, which allowed remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure. * CVE-2012-1573: gnutls_cipher.c in libgnutls in GnuTLS did not properly handle data encrypted with a block cipher, which allowed remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure. * CVE-2012-0390: The DTLS implementation in GnuTLS executed certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which made it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108. Also some non security bugs have been fixed: * Did some more s390x size_t vs int fixes. (bnc#536809, bnc#659128) * re-enabled "legacy negotiation" (bnc#554084) * fix safe-renegotiation for sle10sp3 and sle10sp4 bug (bnc#554084) * fix bug bnc#536809, fix gnutls-cli to abort connection after detecting a bad certificate Security Issue references: * CVE-2009-5138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5138 > * CVE-2011-4108 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4108 > * CVE-2012-0390 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0390 > * CVE-2012-1569 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1569 > * CVE-2012-1573 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573 > * CVE-2013-0169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0169 > * CVE-2013-1619 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1619 > * CVE-2013-2116 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2116 > * CVE-2014-0092 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092 > Package List: - SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64): gnutls-1.2.10-13.38.1 gnutls-devel-1.2.10-13.38.1 - SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64): gnutls-32bit-1.2.10-13.38.1 gnutls-devel-32bit-1.2.10-13.38.1 References: http://support.novell.com/security/cve/CVE-2009-5138.html http://support.novell.com/security/cve/CVE-2011-4108.html http://support.novell.com/security/cve/CVE-2012-0390.html http://support.novell.com/security/cve/CVE-2012-1569.html http://support.novell.com/security/cve/CVE-2012-1573.html http://support.novell.com/security/cve/CVE-2013-0169.html http://support.novell.com/security/cve/CVE-2013-1619.html http://support.novell.com/security/cve/CVE-2013-2116.html http://support.novell.com/security/cve/CVE-2014-0092.html https://bugzilla.novell.com/536809 https://bugzilla.novell.com/554084 https://bugzilla.novell.com/659128 https://bugzilla.novell.com/739898 https://bugzilla.novell.com/753301 https://bugzilla.novell.com/754223 https://bugzilla.novell.com/802651 https://bugzilla.novell.com/821818 https://bugzilla.novell.com/865804 https://bugzilla.novell.com/865993 http://download.novell.com/patch/finder/?keywords=3be1f1e8cc06d24d3e6d4ba2c… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0

[security-announce] SUSE-SU-2014:0319-1: critical: Security update for gnutls
by opensuse-security＠opensuse.org 04 Mar '14

04 Mar '14

SUSE Security Update: Security update for gnutls ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:0319-1 Rating: critical References: #835760 #865804 #865993 Cross-References: CVE-2009-5138 CVE-2014-0092 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise High Availability Extension 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: The GnuTLS library received a critical security fix and other updates: * CVE-2014-0092: The X.509 certificate verification had incorrect error handling, which could lead to broken certificates marked as being valid. * CVE-2009-5138: A verification problem in handling V1 certificates could also lead to V1 certificates incorrectly being handled. Additionally a memory leak in PSK authentication has been fixed (bnc#835760). Security Issue references: * CVE-2014-0092 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0092 > * CVE-2009-5138 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5138 > Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-gnutls-8949 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-gnutls-8949 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-gnutls-8949 - SUSE Linux Enterprise High Availability Extension 11 SP3: zypper in -t patch slehasp3-gnutls-8949 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-gnutls-8949 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-devel-2.4.1-24.39.49.1 libgnutls-extra-devel-2.4.1-24.39.49.1 libgnutls-extra26-2.4.1-24.39.49.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): gnutls-2.4.1-24.39.49.1 libgnutls-extra26-2.4.1-24.39.49.1 libgnutls26-2.4.1-24.39.49.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libgnutls26-32bit-2.4.1-24.39.49.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): gnutls-2.4.1-24.39.49.1 libgnutls-extra26-2.4.1-24.39.49.1 libgnutls26-2.4.1-24.39.49.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libgnutls26-32bit-2.4.1-24.39.49.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libgnutls26-x86-2.4.1-24.39.49.1 - SUSE Linux Enterprise High Availability Extension 11 SP3 (i586 ia64 ppc64 s390x x86_64): libgnutls-extra26-2.4.1-24.39.49.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): gnutls-2.4.1-24.39.49.1 libgnutls26-2.4.1-24.39.49.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libgnutls26-32bit-2.4.1-24.39.49.1 References: http://support.novell.com/security/cve/CVE-2009-5138.html http://support.novell.com/security/cve/CVE-2014-0092.html https://bugzilla.novell.com/835760 https://bugzilla.novell.com/865804 https://bugzilla.novell.com/865993 http://download.novell.com/patch/finder/?keywords=404ba85fa44d8b2dcaf3de46b… -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe(a)opensuse.org For additional commands, e-mail: opensuse-security-announce+help(a)opensuse.org

1 0