----------------------------------------------------------------------

Secunia is pleased to announce the release of the annual Secunia
report for 2008.

Highlights from the 2008 report:
 * Vulnerability Research
 * Software Inspection Results
 * Secunia Research Highlights
 * Secunia Advisory Statistics

Request the full 2008 Report here:
http://secunia.com/advisories/try_vi/request_2008_report/

Stay Secure,

Secunia


----------------------------------------------------------------------

TITLE:
GnuTLS Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA34842

VERIFY ADVISORY:
http://secunia.com/advisories/34842/

DESCRIPTION:
Some security issues and vulnerabilities have been reported in
GnuTLS, which can be exploited by malicious people to conduct
spoofing attacks, bypass certain security restrictions, or
potentially compromise a user's system.

1) An error when processing invalid DSA keys can be exploited to free
invalid memory and cause a crash in a client application via an
invalid DSA signature.

Successful exploitation may allow execution of arbitrary code.

2) The library generates RSA keys instead of DSA keys, resulting in
potentially cryptographically weak signatures.

NOTE: Reportedly, the verification of the improperly generated
signatures usually fails.

3) The "gnutls-cli" application improperly checks the activation and
expiration dates of X.509 certificates. This can be exploited to
trick the application into accepting an invalid certificate.

The vulnerabilities are reported in versions prior to 2.6.6.

SOLUTION:
Update to version 2.6.6. Please see the vendor's advisories for more
details.

PROVIDED AND/OR DISCOVERED BY:
The vendor credits:
1) Miroslav Kratochvil
2) Simon Josefsson
3) Romain Francoise

ORIGINAL ADVISORY:
GNUTLS-SA-2009-1:
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3515

GNUTLS-SA-2009-2:
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3516

GNUTLS-SA-2009-3:
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3517

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------