Skip to navigation

Security Advisory Moderate: gnutls security update

Advisory: RHSA-2010:0167-1
Type: Security Advisory
Severity: Moderate
Issued on: 2010-03-25
Last updated on: 2010-03-25
Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.8.z)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.8.z)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2009-3555
CVE-2010-0731

Details

Updated gnutls packages that fix two security issues are now available for
Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

The GnuTLS library provides support for cryptographic algorithms and for
protocols such as Transport Layer Security (TLS).

A flaw was found in the way the TLS/SSL (Transport Layer Security/Secure
Sockets Layer) protocols handled session renegotiation. A man-in-the-middle
attacker could use this flaw to prefix arbitrary plain text to a client's
session (for example, an HTTPS connection to a website). This could force
the server to process an attacker's request as if authenticated using the
victim's credentials. This update addresses this flaw by implementing the
TLS Renegotiation Indication Extension, as defined in RFC 5746.
(CVE-2009-3555)

Refer to the following Knowledgebase article for additional details about
the CVE-2009-3555 flaw: http://kbase.redhat.com/faq/docs/DOC-20491

A flaw was found in the way GnuTLS extracted serial numbers from X.509
certificates. On 64-bit big endian platforms, this flaw could cause the
certificate revocation list (CRL) check to be bypassed; cause various
GnuTLS utilities to crash; or, possibly, execute arbitrary code.
(CVE-2010-0731)

Users of GnuTLS are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. For the update to take
effect, all applications linked to the GnuTLS library must be restarted, or
the system rebooted.


Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

Red Hat Desktop (v. 4)

SRPMS:
gnutls-1.0.20-4.el4_8.7.src.rpm     MD5: 7a1bb5ea7a08e7c8d01a3c7fad1d3136
SHA-256: 46222cc8e30ce2c11262c33df7d1791afd989c3486f46f53b975d5d847152849
 
IA-32:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-devel-1.0.20-4.el4_8.7.i386.rpm     MD5: 7e3ead6bb136942baa0c285cdbfee1b9
SHA-256: 65dd2c88cc20599ffc6de51408b0e42342e435b1cea9593a30e1b9f9c7fce878
 
x86_64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.x86_64.rpm     MD5: 6ef00c4bddaff6d26d4fd2895e7bc051
SHA-256: 4447b866521bfb87781a81f5b22e137e999b93b30a959712ef3aa336cbc09f05
gnutls-devel-1.0.20-4.el4_8.7.x86_64.rpm     MD5: ce466df6883d88fa31ff5dda9707bb43
SHA-256: 4a30dcf728c1ba452facd44a30ea57b7b5022aa2ce1077609fd449538fb48125
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
gnutls-1.0.20-4.el4_8.7.src.rpm     MD5: 7a1bb5ea7a08e7c8d01a3c7fad1d3136
SHA-256: 46222cc8e30ce2c11262c33df7d1791afd989c3486f46f53b975d5d847152849
 
IA-32:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-devel-1.0.20-4.el4_8.7.i386.rpm     MD5: 7e3ead6bb136942baa0c285cdbfee1b9
SHA-256: 65dd2c88cc20599ffc6de51408b0e42342e435b1cea9593a30e1b9f9c7fce878
 
IA-64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.ia64.rpm     MD5: cd9fccdeb01ca70fa832618e1a78ac0e
SHA-256: b303e6accaf6940bbd246c3c1178d81671662ef478389b758589362840b13726
gnutls-devel-1.0.20-4.el4_8.7.ia64.rpm     MD5: 7913621912238aa986e49543f1c0e287
SHA-256: 28da81731563b4061adeca8d922c5bba77f7a10de1035c2373c05d24db058947
 
PPC:
gnutls-1.0.20-4.el4_8.7.ppc.rpm     MD5: 3f5cbd3c947b5da64734f029c4c462ed
SHA-256: 025eea0fc6aa34164fa7ef336eadd7d32d389f243848619459e96d8699fb5f9d
gnutls-1.0.20-4.el4_8.7.ppc64.rpm     MD5: 866e99dba716dfb246c3b156f29b2a85
SHA-256: 8c527fc16354f4b667021eb4eda27440dec1fd4058ea4beea9721317e98052de
gnutls-devel-1.0.20-4.el4_8.7.ppc.rpm     MD5: c55f2ef15ff0861301665eb0e193af52
SHA-256: 6c25be50c58603b6cc0751f770f9576db18387a6b74f405d618ad9eb48954b5d
 
s390:
gnutls-1.0.20-4.el4_8.7.s390.rpm     MD5: 1f30c3c60fc5f9481f76133bb19eda37
SHA-256: 9e6ccd1ed29e931839454b6e877e646a350a43ca47f2d048e10cb3127dae9b52
gnutls-devel-1.0.20-4.el4_8.7.s390.rpm     MD5: 0aa0d6a84bef2f4c3202a6ef4f7e9473
SHA-256: a8d67dfb99d775a86341c2e7d1347ee9d7e661ef95bd043650d41d542601b16a
 
s390x:
gnutls-1.0.20-4.el4_8.7.s390.rpm     MD5: 1f30c3c60fc5f9481f76133bb19eda37
SHA-256: 9e6ccd1ed29e931839454b6e877e646a350a43ca47f2d048e10cb3127dae9b52
gnutls-1.0.20-4.el4_8.7.s390x.rpm     MD5: 480fa0d01dea5e6dcd5a8b4f25559c1f
SHA-256: 848b38f1e84fb19e1fabd88c2a7465fdc14dc8b8702faa257d3ac378701b28c4
gnutls-devel-1.0.20-4.el4_8.7.s390x.rpm     MD5: ddd1df350fa64c78ca7841277204a68a
SHA-256: f5f9d1446c82e63a85e3396b93f20c7c1929d6aebc4222996d5c15b0a9ed06fe
 
x86_64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.x86_64.rpm     MD5: 6ef00c4bddaff6d26d4fd2895e7bc051
SHA-256: 4447b866521bfb87781a81f5b22e137e999b93b30a959712ef3aa336cbc09f05
gnutls-devel-1.0.20-4.el4_8.7.x86_64.rpm     MD5: ce466df6883d88fa31ff5dda9707bb43
SHA-256: 4a30dcf728c1ba452facd44a30ea57b7b5022aa2ce1077609fd449538fb48125
 
Red Hat Enterprise Linux AS (v. 4.8.z)

SRPMS:
gnutls-1.0.20-4.el4_8.7.src.rpm     MD5: 7a1bb5ea7a08e7c8d01a3c7fad1d3136
SHA-256: 46222cc8e30ce2c11262c33df7d1791afd989c3486f46f53b975d5d847152849
 
IA-32:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-devel-1.0.20-4.el4_8.7.i386.rpm     MD5: 7e3ead6bb136942baa0c285cdbfee1b9
SHA-256: 65dd2c88cc20599ffc6de51408b0e42342e435b1cea9593a30e1b9f9c7fce878
 
IA-64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.ia64.rpm     MD5: cd9fccdeb01ca70fa832618e1a78ac0e
SHA-256: b303e6accaf6940bbd246c3c1178d81671662ef478389b758589362840b13726
gnutls-devel-1.0.20-4.el4_8.7.ia64.rpm     MD5: 7913621912238aa986e49543f1c0e287
SHA-256: 28da81731563b4061adeca8d922c5bba77f7a10de1035c2373c05d24db058947
 
PPC:
gnutls-1.0.20-4.el4_8.7.ppc.rpm     MD5: 3f5cbd3c947b5da64734f029c4c462ed
SHA-256: 025eea0fc6aa34164fa7ef336eadd7d32d389f243848619459e96d8699fb5f9d
gnutls-1.0.20-4.el4_8.7.ppc64.rpm     MD5: 866e99dba716dfb246c3b156f29b2a85
SHA-256: 8c527fc16354f4b667021eb4eda27440dec1fd4058ea4beea9721317e98052de
gnutls-devel-1.0.20-4.el4_8.7.ppc.rpm     MD5: c55f2ef15ff0861301665eb0e193af52
SHA-256: 6c25be50c58603b6cc0751f770f9576db18387a6b74f405d618ad9eb48954b5d
 
s390:
gnutls-1.0.20-4.el4_8.7.s390.rpm     MD5: 1f30c3c60fc5f9481f76133bb19eda37
SHA-256: 9e6ccd1ed29e931839454b6e877e646a350a43ca47f2d048e10cb3127dae9b52
gnutls-devel-1.0.20-4.el4_8.7.s390.rpm     MD5: 0aa0d6a84bef2f4c3202a6ef4f7e9473
SHA-256: a8d67dfb99d775a86341c2e7d1347ee9d7e661ef95bd043650d41d542601b16a
 
s390x:
gnutls-1.0.20-4.el4_8.7.s390.rpm     MD5: 1f30c3c60fc5f9481f76133bb19eda37
SHA-256: 9e6ccd1ed29e931839454b6e877e646a350a43ca47f2d048e10cb3127dae9b52
gnutls-1.0.20-4.el4_8.7.s390x.rpm     MD5: 480fa0d01dea5e6dcd5a8b4f25559c1f
SHA-256: 848b38f1e84fb19e1fabd88c2a7465fdc14dc8b8702faa257d3ac378701b28c4
gnutls-devel-1.0.20-4.el4_8.7.s390x.rpm     MD5: ddd1df350fa64c78ca7841277204a68a
SHA-256: f5f9d1446c82e63a85e3396b93f20c7c1929d6aebc4222996d5c15b0a9ed06fe
 
x86_64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.x86_64.rpm     MD5: 6ef00c4bddaff6d26d4fd2895e7bc051
SHA-256: 4447b866521bfb87781a81f5b22e137e999b93b30a959712ef3aa336cbc09f05
gnutls-devel-1.0.20-4.el4_8.7.x86_64.rpm     MD5: ce466df6883d88fa31ff5dda9707bb43
SHA-256: 4a30dcf728c1ba452facd44a30ea57b7b5022aa2ce1077609fd449538fb48125
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
gnutls-1.0.20-4.el4_8.7.src.rpm     MD5: 7a1bb5ea7a08e7c8d01a3c7fad1d3136
SHA-256: 46222cc8e30ce2c11262c33df7d1791afd989c3486f46f53b975d5d847152849
 
IA-32:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-devel-1.0.20-4.el4_8.7.i386.rpm     MD5: 7e3ead6bb136942baa0c285cdbfee1b9
SHA-256: 65dd2c88cc20599ffc6de51408b0e42342e435b1cea9593a30e1b9f9c7fce878
 
IA-64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.ia64.rpm     MD5: cd9fccdeb01ca70fa832618e1a78ac0e
SHA-256: b303e6accaf6940bbd246c3c1178d81671662ef478389b758589362840b13726
gnutls-devel-1.0.20-4.el4_8.7.ia64.rpm     MD5: 7913621912238aa986e49543f1c0e287
SHA-256: 28da81731563b4061adeca8d922c5bba77f7a10de1035c2373c05d24db058947
 
x86_64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.x86_64.rpm     MD5: 6ef00c4bddaff6d26d4fd2895e7bc051
SHA-256: 4447b866521bfb87781a81f5b22e137e999b93b30a959712ef3aa336cbc09f05
gnutls-devel-1.0.20-4.el4_8.7.x86_64.rpm     MD5: ce466df6883d88fa31ff5dda9707bb43
SHA-256: 4a30dcf728c1ba452facd44a30ea57b7b5022aa2ce1077609fd449538fb48125
 
Red Hat Enterprise Linux ES (v. 4.8.z)

SRPMS:
gnutls-1.0.20-4.el4_8.7.src.rpm     MD5: 7a1bb5ea7a08e7c8d01a3c7fad1d3136
SHA-256: 46222cc8e30ce2c11262c33df7d1791afd989c3486f46f53b975d5d847152849
 
IA-32:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-devel-1.0.20-4.el4_8.7.i386.rpm     MD5: 7e3ead6bb136942baa0c285cdbfee1b9
SHA-256: 65dd2c88cc20599ffc6de51408b0e42342e435b1cea9593a30e1b9f9c7fce878
 
IA-64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.ia64.rpm     MD5: cd9fccdeb01ca70fa832618e1a78ac0e
SHA-256: b303e6accaf6940bbd246c3c1178d81671662ef478389b758589362840b13726
gnutls-devel-1.0.20-4.el4_8.7.ia64.rpm     MD5: 7913621912238aa986e49543f1c0e287
SHA-256: 28da81731563b4061adeca8d922c5bba77f7a10de1035c2373c05d24db058947
 
x86_64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.x86_64.rpm     MD5: 6ef00c4bddaff6d26d4fd2895e7bc051
SHA-256: 4447b866521bfb87781a81f5b22e137e999b93b30a959712ef3aa336cbc09f05
gnutls-devel-1.0.20-4.el4_8.7.x86_64.rpm     MD5: ce466df6883d88fa31ff5dda9707bb43
SHA-256: 4a30dcf728c1ba452facd44a30ea57b7b5022aa2ce1077609fd449538fb48125
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
gnutls-1.0.20-4.el4_8.7.src.rpm     MD5: 7a1bb5ea7a08e7c8d01a3c7fad1d3136
SHA-256: 46222cc8e30ce2c11262c33df7d1791afd989c3486f46f53b975d5d847152849
 
IA-32:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-devel-1.0.20-4.el4_8.7.i386.rpm     MD5: 7e3ead6bb136942baa0c285cdbfee1b9
SHA-256: 65dd2c88cc20599ffc6de51408b0e42342e435b1cea9593a30e1b9f9c7fce878
 
IA-64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.ia64.rpm     MD5: cd9fccdeb01ca70fa832618e1a78ac0e
SHA-256: b303e6accaf6940bbd246c3c1178d81671662ef478389b758589362840b13726
gnutls-devel-1.0.20-4.el4_8.7.ia64.rpm     MD5: 7913621912238aa986e49543f1c0e287
SHA-256: 28da81731563b4061adeca8d922c5bba77f7a10de1035c2373c05d24db058947
 
x86_64:
gnutls-1.0.20-4.el4_8.7.i386.rpm     MD5: eb09e2a8aa18de090e4e4bf0d04fb4d6
SHA-256: 617acd68eca5b17004557d122bfd716d7b0374d8ecf295e1622018da1da29fbd
gnutls-1.0.20-4.el4_8.7.x86_64.rpm     MD5: 6ef00c4bddaff6d26d4fd2895e7bc051
SHA-256: 4447b866521bfb87781a81f5b22e137e999b93b30a959712ef3aa336cbc09f05
gnutls-devel-1.0.20-4.el4_8.7.x86_64.rpm     MD5: ce466df6883d88fa31ff5dda9707bb43
SHA-256: 4a30dcf728c1ba452facd44a30ea57b7b5022aa2ce1077609fd449538fb48125
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

533125 - CVE-2009-3555 TLS: MITM attacks via session renegotiation
573028 - CVE-2010-0731 gnutls: gnutls_x509_crt_get_serial incorrect serial decoding from ASN1 (BE64) [GNUTLS-SA-2010-1]


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/