Scientific Linux Security Update : gnutls on SL5.x i386/x86_64

Critical Nessus Plugin ID 60401

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

Flaws were found in the way GnuTLS handles malicious client connections. A malicious remote client could send a specially crafted request to a service using GnuTLS that could cause the service to crash. (CVE-2008-1948, CVE-2008-1949, CVE-2008-1950)

At this time we have not seen any code that is using this exploit. But in Scientific Linux 5 there are some applications, such as CUPS, that would be directly vulnerable if/when there is an exploit. Because of the potential threat we are labeling this critical.

Solution

Update the affected gnutls, gnutls-devel and / or gnutls-utils packages.

See Also

http://www.nessus.org/u?1b7621f4

Plugin Details

Severity: Critical

ID: 60401

File Name: sl_20080520_gnutls_on_SL5_x.nasl

Version: 1.3

Type: local

Agent: unix

Published: 2012/08/01

Updated: 2019/01/07

Dependencies: 12634

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2008/05/20

Reference Information

CVE: CVE-2008-1948, CVE-2008-1949, CVE-2008-1950

CWE: 189, 287