Security World: [SECURITY] [DSA 1719-1] New gnutls13 packages fix certificate validation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1719-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
February 10, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : gnutls13
Vulnerability : design flaw
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2008-4989
Debian Bug : 505360

Martin von Gagern discovered that GNUTLS, an implementation of the
TLS/SSL protocol, handles verification of X.509 certificate chains
incorrectly if a self-signed certificate is configured as a trusted
certificate. This could cause clients to accept forged server
certificates as genuine. (CVE-2008-4989)

In addition, this update tightens the checks for X.509v1 certificates
which causes GNUTLS to reject certain certificate chains it accepted
before. (In certificate chain processing, GNUTLS does not recognize
X.509v1 certificates as valid unless explicitly requested by the
application.)

For the stable distribution (etch), this problem has been fixed in
version 1.4.4-3+etch3.

For the unstable distribution (sid), this problem has been fixed in
version 2.4.2-3 of the gnutls26 package.

We recommend that you upgrade your gnutls13 packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4-3+etch2.dsc
Size/MD5 checksum: 967 97d676fb2a9de5a2706da79baf5fc53f
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4-3+etch3.diff.gz
Size/MD5 checksum: 20931 d1f9a5483e2ff3b6f799f14cc90e0ba4
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4.orig.tar.gz
Size/MD5 checksum: 4752009 c06ada020e2b69caa51833175d59f8b2
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4-3+etch2.diff.gz
Size/MD5 checksum: 19550 d362897a57e2bac2f059413ea29540be
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4-3+etch3.dsc
Size/MD5 checksum: 967 c523874d91b1d19b0a59c6d51ada21e6

Architecture independent packages:

http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-doc_1.4.4-3+etch2_all.deb
Size/MD5 checksum: 2315360 2892fedc83604472a40cb9e16b64fad2
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-doc_1.4.4-3+etch3_all.deb
Size/MD5 checksum: 2315508 9fe5532897a55d3f8b2954a7294920e1

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch3_amd64.deb
Size/MD5 checksum: 314678 9a2fca4364ab01e77da051e1c637cace
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch2_amd64.deb
Size/MD5 checksum: 538540 9bad40a6891bacf73ab92d492946439e
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch2_amd64.deb
Size/MD5 checksum: 183432 04c381e380452347c0b8c866cd32a0d1
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch2_amd64.deb
Size/MD5 checksum: 314542 bd3466107c5a3e81bae9fc6ce16b3f07
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch3_amd64.deb
Size/MD5 checksum: 389192 7e1f1ee9b50dbe59303ee92d06d638f9
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch3_amd64.deb
Size/MD5 checksum: 183526 deb90128a086f94d4213ae8d0ebb2aac
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch2_amd64.deb
Size/MD5 checksum: 389078 937898ee8ebfbb6c96ec327182aa66c9
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch3_amd64.deb
Size/MD5 checksum: 538694 30f0f5f5236de80b969ab142003facda

arm architecture (ARM)

http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch3_arm.deb
Size/MD5 checksum: 355130 d314daec4d8653d21f5aa755b133ce44
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch2_arm.deb
Size/MD5 checksum: 169734 a0760138aa40ef409bebc45f21482fa6
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch3_arm.deb
Size/MD5 checksum: 283218 86a51ac92283cf4d41f8b80e208d3ea0
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch2_arm.deb
Size/MD5 checksum: 283146 490e93a8fb47792bab27befcfaba59c4
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch2_arm.deb
Size/MD5 checksum: 510986 734ae4e95a95858b98a9aadf3df89e27
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch2_arm.deb
Size/MD5 checksum: 355034 d2fad7c1fa481c311272a033a1632baa
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch3_arm.deb
Size/MD5 checksum: 511146 020e108874b330b04d28cbf111e1cb3c
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch3_arm.deb
Size/MD5 checksum: 169790 d7904cea32e23dcd2abe3c8078029f24

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch2_hppa.deb
Size/MD5 checksum: 435274 a50a1b0396725750c7f9b18f42ed59df
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch3_hppa.deb
Size/MD5 checksum: 521900 81a5514ae8b882945c9d86260a985075
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch2_hppa.deb
Size/MD5 checksum: 312696 9b01cc660ec19e94365cfe9485e69504
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch3_hppa.deb
Size/MD5 checksum: 435428 b9b85897a5fa12e6145e44f1d811faf7
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch2_hppa.deb
Size/MD5 checksum: 184434 3fe517f3ae76a0bb39ef2112259ee533
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch3_hppa.deb
Size/MD5 checksum: 312786 7bf4a07c716180831b812024f9dc2bed
http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch2_hppa.deb
Size/MD5 checksum: 521782 ec2e351f911c06d10a906e35e87b17d8
http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch3_hppa.deb
Size/MD5 checksum: 184514 4a4436b484d0809e458fccd777af41a9

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJkSYVAAoJEL97/wQC1SS+Nc4H/2TnDuV0VpsjmK/uRsQx99R/
bUkz4ZcTFzMP5VztCE4gNMy0UmVNyk6mtu87L2Md0JnHWPU3xY7+2ZZFZ6DfjUpQ
7GGwl4DN6y3ge2/F2QIMid3iSolJaXQ2lkj/50OelS/MwTTDNQ6Q5W6SFet40SOr
rCRDLQFCW7mgkCPa9v+meXWRy1wuSx6h5UAr6wMIy0Z/20BrQtS+8hyHxOHtxbGQ
FhFMa3n6KySUt9JbJ7QipSBxIqn2oTmaNy4AL3W5dpGY7UEoBxQ/67S2hAnhoTZH
i7ipu3PQMWX+ov1uyIe3EEQmIQpfyHA3EwKujJNIozI88NeuWdJF18AIbuQrodo=
=N+Yn
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Monday, February 09, 2009

[SECURITY] [DSA 1719-1] New gnutls13 packages fix certificate validation

No comments: