A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.

A use-after-free flaw was found in GnuTLS's gnutlsx509dntostring() function. A remote attacker could create a specially crafted certificate with very long DistinguishedName (DN) entries that, when processed by an application compiled against GnuTLS, could cause that application to crash.

This issue was fixed in upstream versions 3.4.4 and 3.3.17 of GnuTLS:

https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007707.html https://lists.gnupg.org/pipermail/gnutls-devel/2015-August/007708.html

The following patch fixes this issue:

https://gitlab.com/gnutls/gnutls/commit/272854367efc130fbd4f1a51840d80c630214e12

The affected function, gnutlsx509dntostring(), was first introduced in version 3.1.10 via commit:

https://gitlab.com/gnutls/gnutls/commit/6be35136333b5d6289f23209cf896e741462909a

The gnutls packages in Red Hat Enterprise Linux 6 and earlier include GnuTLS versions 2.x or 1.x and are therefore not affected by this issue.

External References:

http://www.gnutls.org/security.html#GNUTLS-SA-2015-3

GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.

The authentication hook (mgshookauthz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.

IssueDescription:

An out-of-bounds memory write flaw was found in the way GnuTLS parsed certain ECC (Elliptic Curve Cryptography) certificates or certificate signing requests (CSR). A malicious user could create a specially crafted ECC certificate or a certificate signing request that, when processed by an application compiled against GnuTLS (for example, certtool), could cause that application to crash or execute arbitrary code with the permissions of the user running the application.

Buffer overflow in the danequerytlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service (buffer over-read and crash) via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169.

The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.

A flaw was reported [1] in the GnuTLS gnutlssessiongetdata() function, which could overflow a too-short buffer parameter allocated by the caller. The test which was to avoid such buffer overflows was not working. A malicious server could use this flaw in a vulnerable client to send a larger SessionTicket in the hope of overflowing the client.

Upstream has indicated that they are unaware of any client software that does not properly use the session resumption functions; clients that perform session resumption as documented [2] are not vulnerable.

[1] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596 [2] http://www.gnu.org/s/gnutls/manual/htmlnode/Client-with-Resume-capability-example.html#Client-with-Resume-capability-example

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Mutt 1.5.19, when linked against (1) OpenSSL (muttssl.c) or (2) GnuTLS (muttsslgnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.

gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutlsx509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.

lib/pk-libgcrypt.c in libgnutls in GnuTLS before 2.6.6 does not properly handle invalid DSA signatures, which allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a malformed DSA key that triggers a (1) free of an uninitialized pointer or (2) double free.

The gnutlsx509verifycertificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).

Integer signedness error in the gnutlsciphertext2compressed function in lib/gnutlscipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.