The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0594 advisory.

    [1.4.1-16]
    - added missing check for null pointer (#1102355)

    [1.4.1-15]
    - fix session ID length check and null pointer dereference (#1102355)
    - fix minitasn1 issues (#1102355)
    - Renamed gnutls-1.4.1-cve-2014-5138.patch to cve-2009-5138.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally, three issues inherited from libtasn1 have been fixed.

Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3

These security issues have been fixed :

  - Possible memory corruption during connect.
    (CVE-2014-3466)

  - Multiple boundary check issues could allow DoS.
    (CVE-2014-3467)

  - asn1_get_bit_der() can return negative bit length.
    (CVE-2014-3468)

  - Possible DoS by NULL pointer dereference (CVE-2014-3469)

Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 (Abstract Syntax Notation One) structures. An attacker could use those to cause a denial-of-service via out-of-bounds access or NULL pointer dereference.

The remote Solaris system is missing necessary patches to address security updates :

  - The gnutls_x509_dn_oid_name function in     lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x     before 3.2.10 allows remote attackers to cause a denial     of service (NULL pointer dereference) via a crafted     X.509 certificate, related to a missing LDAP description     for an OID when printing the DN. (CVE-2014-3465)

  - Buffer overflow in the read_server_hello function in     lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x     before 3.2.15, and 3.3.x before 3.3.4 allows remote     servers to cause a denial of service (memory corruption)     or possibly execute arbitrary code via a long session id     in a ServerHello message. (CVE-2014-3466)

  - Multiple unspecified vulnerabilities in the DER decoder     in GNU Libtasn1 before 3.6, as used in GnutTLS, allow     remote attackers to cause a denial of service     (out-of-bounds read) via a crafted ASN.1 data.
    (CVE-2014-3467)

  - The asn1_get_bit_der function in GNU Libtasn1 before 3.6     does not properly report an error when a negative bit     length is identified, which allows context-dependent     attackers to cause out-of-bounds access via crafted     ASN.1 data. (CVE-2014-3468)

  - The (1) asn1_read_value_type and (2) asn1_read_value     functions in GNU Libtasn1 before 3.6 allows     context-dependent attackers to cause a denial of service     (NULL pointer dereference and crash) via a NULL value in     an ivalue argument. (CVE-2014-3469)

Updated libtasn1 packages fix security vulnerabilities :

Multiple buffer boundary check issues were discovered in libtasn1 library, causing it to read beyond the boundary of an allocated buffer. An untrusted ASN.1 input could cause an application using the library to crash (CVE-2014-3467).

It was discovered that libtasn1 library function asn1_get_bit_der() could incorrectly report negative bit length of the value read from ASN.1 input. This could possibly lead to an out of bounds access in an application using libtasn1, for example in case if application tried to terminate read value with NUL byte (CVE-2014-3468).

A NULL pointer dereference flaw was found in libtasn1's asn1_read_value_type() / asn1_read_value() function. If an application called the function with a NULL value for an ivalue argument to determine the amount of memory needed to store data to be read from the ASN.1 input, libtasn1 could incorrectly attempt to dereference the NULL pointer, causing an application using the library to crash (CVE-2014-3469).

An updated rhev-hypervisor6 package that fixes several security issues is now available.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: a subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code. (CVE-2014-3466)

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data.
Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.
(CVE-2014-3468)

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467)

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469)

Red Hat would like to thank GnuTLS upstream for reporting CVE-2014-3466, CVE-2014-3468, CVE-2014-3467, and CVE-2014-3469.
Upstream acknowledges Joonas Kuorilehto of Codenomicon as the original reporter of CVE-2014-3466.

This updated package provides an updated kernel component that includes fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers :

CVE-2013-6378, CVE-2014-0203, CVE-2014-1737, CVE-2014-1738, CVE-2014-1874, CVE-2014-2039 and CVE-2014-3153 (kernel issues)

Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS,     allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
    (CVE-2014-3467)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data.
Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.
(CVE-2014-3468)

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467)

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469)

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data.
Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.
(CVE-2014-3468)

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467)

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469)

For the update to take effect, all applications linked to the libtasn1 library must be restarted.

New libtasn1 packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0596 advisory.

    [2.3-6]
    - added check for null pointer (#1102336)

    [2.3-5]
    - fix various DER decoding issues (#1102336)

    [2.3-4]
    - fix CVE-2012-1569 - missing length check when decoding DER lengths (#804920)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0687 advisory.

    The libtasn1 library provides Abstract Syntax Notation One (ASN.1) parsing     and structures management, and Distinguished Encoding Rules (DER) encoding     and decoding functions.

    It was discovered that the asn1_get_bit_der() function of the libtasn1     library incorrectly reported the length of ASN.1-encoded data. Specially     crafted ASN.1 input could cause an application using libtasn1 to perform     an out-of-bounds access operation, causing the application to crash or,     possibly, execute arbitrary code. (CVE-2014-3468)

    Multiple incorrect buffer boundary check issues were discovered in     libtasn1. Specially crafted ASN.1 input could cause an application using     libtasn1 to crash. (CVE-2014-3467)

    Multiple NULL pointer dereference flaws were found in libtasn1's     asn1_read_value() function. Specially crafted ASN.1 input could cause an     application using libtasn1 to crash, if the application used the     aforementioned function in a certain way. (CVE-2014-3469)

    Red Hat would like to thank GnuTLS upstream for reporting these issues.

    All libtasn1 users are advised to upgrade to these updated packages, which     correct these issues. For the update to take effect, all applications     linked to the libtasn1 library must be restarted.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
74296	Oracle Linux 5 : gnutls (ELSA-2014-0594)	Nessus	Oracle Linux Local Security Checks	6/4/2014	10/22/2024	critical
74321	SuSE 11.3 Security Update : gnutls (SAT Patch Number 9320)	Nessus	SuSE Local Security Checks	6/5/2014	1/19/2021	medium
78681	Debian DSA-3056-1 : libtasn1-3 - security update	Nessus	Debian Local Security Checks	10/27/2014	1/11/2021	medium
80632	Oracle Solaris Third-Party Patch Update : gnutls (multiple_vulnerabilities_in_gnutls)	Nessus	Solaris Local Security Checks	1/19/2015	1/14/2021	medium
82369	Mandriva Linux Security Advisory : libtasn1 (MDVSA-2015:116)	Nessus	Mandriva Local Security Checks	3/30/2015	1/14/2021	medium
79108	RHEL 6 : rhev-hypervisor6 (RHSA-2014:0815)	Nessus	Red Hat Local Security Checks	11/11/2014	1/14/2021	medium
218190	Linux Distros Unpatched Vulnerability : CVE-2014-3467	Nessus	Misc.	3/4/2025	1/28/2026	critical
78302	Amazon Linux AMI : libtasn1 (ALAS-2014-359)	Nessus	Amazon Linux Local Security Checks	10/12/2014	4/18/2018	medium
74307	Scientific Linux Security Update : libtasn1 on SL6.x i386/x86_64 (20140603)	Nessus	Scientific Linux Local Security Checks	6/4/2014	1/14/2021	medium
74330	Slackware 14.0 / 14.1 / current : libtasn1 (SSA:2014-156-02)	Nessus	Slackware Local Security Checks	6/6/2014	1/14/2021	medium
74298	Oracle Linux 6 : libtasn1 (ELSA-2014-0596)	Nessus	Oracle Linux Local Security Checks	6/4/2014	10/23/2024	critical
76896	RHEL 7 : libtasn1 (RHSA-2014:0687)	Nessus	Red Hat Local Security Checks	7/30/2014	4/15/2025	critical

Detections

Analytics

Plugins Search

critical

medium

medium

medium

medium

medium

critical

medium

medium

medium

critical

critical