USN-678-2: GnuTLS regression | Ubuntu security notices

Packages

Details

USN-678-1 fixed a vulnerability in GnuTLS. The upstream patch introduced a
regression when validating certain certificate chains that would report valid
certificates as untrusted. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Martin von Gagern discovered that GnuTLS did not properly verify certificate
chains when the last certificate in the chain was self-signed. If a remote
attacker were able to perform a machine-in-the-middle attack, this flaw could be
exploited to view sensitive information. (CVE-2008-4989)

USN-678-1 fixed a vulnerability in GnuTLS. The upstream patch introduced a
regression when validating certain certificate chains that would report valid
certificates as untrusted. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Martin von Gagern discovered that GnuTLS did not properly verify certificate
chains when the last certificate in the chain was self-signed. If a remote
attacker were able to perform a machine-in-the-middle attack, this flaw could be
exploited to view sensitive information. (CVE-2008-4989)

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
8.10 intrepid	libgnutls26 – 2.4.1-1ubuntu0.2
8.04 hardy	libgnutls13 – 2.0.4-1ubuntu2.3
7.10 gutsy	libgnutls13 – 1.6.3-1ubuntu0.3
6.06 dapper	libgnutls12 – 1.2.9-2ubuntu1.4

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

https://launchpad.net/bugs/305264