[ GLSA 200901-10 ] GnuTLS: Certificate validation error

[GLSA]

Gentoo Linux Security Advisory

Title: GnuTLS: Certificate validation error (GLSA 200901-10)
Severity: normal
Exploitable: remote
Date: January 14, 2009
Bug(s): #245850
ID: 200901-10

Synopsis


A certificate validation error in GnuTLS might allow for spoofing attacks.


Background


GnuTLS is an open-source implementation of TLS 1.0 and SSL 3.0.


Affected Packages

Package: net-libs/gnutls
Vulnerable: < 2.4.1-r2
Unaffected: >= 2.4.1-r2
Architectures: All supported architectures


Description


Martin von Gagern reported that the _gnutls_x509_verify_certificate()
function in lib/x509/verify.c trusts certificate chains in which the
last certificate is an arbitrary trusted, self-signed certificate.


Impact


A remote attacker could exploit this vulnerability and spoof arbitrary
names to conduct Man-In-The-Middle attacks and intercept sensitive
information.


Workaround


There is no known workaround at this time.


Resolution


All GnuTLS users should upgrade to the latest version: