Scientific Linux Security Update : gnutls on SL4.x i386/x86_64

critical Nessus Plugin ID 60400

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

Flaws were found in the way GnuTLS handles malicious client connections. A malicious remote client could send a specially crafted request to a service using GnuTLS that could cause the service to crash. (CVE-2008-1948, CVE-2008-1949, CVE-2008-1950)

At this time we have not seen any code that is using this exploit. But in Scientific Linux 5 there are some applications, that would be directly vulnerable if/when there is an exploit. Because of the potential threat we are labeling this important.

Solution

Update the affected gnutls and / or gnutls-devel packages.

See Also

http://www.nessus.org/u?6eb4ba66

Plugin Details

Severity: Critical

ID: 60400

File Name: sl_20080520_gnutls_on_SL4_x.nasl

Version: 1.6

Type: local

Agent: unix

Published: 8/1/2012

Updated: 1/14/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 5/20/2008

Reference Information

CVE: CVE-2008-1948, CVE-2008-1949, CVE-2008-1950

CWE: 189, 287