Bug 865993 (CVE-2009-5138) - VUL-0: CVE-2009-5138: gnutls: incorrect handling of V1 intermediate certificates
Summary: VUL-0: CVE-2009-5138: gnutls: incorrect handling of V1 intermediate certificates
Status: RESOLVED FIXED
Alias: CVE-2009-5138
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P1 - Urgent : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/96616/
Whiteboard: maint:released:sle10-sp3:56455 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-27 09:28 UTC by Victor Pereira
Modified: 2014-03-25 18:05 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-02-27 09:28:21 UTC 
CVE-2009-5138

While investigating GnuTLS issue CVE-2014-1959 (bnc#863989), it was discovered that older versions of GnuTLS were affected by the same problem, with a different root cause.  When using default certificate verification settings, GnuTLS accepted version 1 X.509 certificates as intermediate CAs.  An attacker able to obtain a V1 certificate from a CA trusted by application could generate certificates for other hosts or users that would be accepted by GnuTLS.

This issue affected GnuTLS versions before 2.7.6.  Problem was reported in the following post:

http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3351/focus=3361

and fixed upstream via:

https://gitorious.org/gnutls/gnutls/commit/c8dcbedd1fdc312f5b1a70fcfbc1afe235d800cd

This did not affect applications that used GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT verification flag, which instructs GnuTLS to allow root CA certificates to be version 1 certificates.  This was set by e.g. gnutls-cli client application in GnuTLS versions affected by this bug.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1069301
Comment 5 Marcus Meissner 2014-02-27 17:37:23 UTC 
SLES 9 is not affected by this problem, the xor code is not present.
Comment 8 Swamp Workflow Management 2014-03-03 20:46:54 UTC 
Update released for: gnutls, gnutls-debuginfo, gnutls-debugsource, libgnutls-devel, libgnutls-extra-devel, libgnutls-extra26, libgnutls26, libgnutls26-32bit, libgnutls26-x86
Products:
SLE-DEBUGINFO 11-SP1 (i386, s390x, x86_64)
SLE-SERVER 11-SP1-LTSS (i386, s390x, x86_64)
Comment 9 Swamp Workflow Management 2014-03-03 20:49:35 UTC 
Update released for: gnutls, gnutls-32bit, gnutls-debuginfo, gnutls-devel, gnutls-devel-32bit, gnutls-x86
Products:
SLE-DEBUGINFO 10-SP4 (i386, s390x, x86_64)
SLE-SERVER 10-SP4-LTSS (i386, s390x, x86_64)
Comment 10 Swamp Workflow Management 2014-03-03 20:52:20 UTC 
Update released for: gnutls, gnutls-32bit, gnutls-debuginfo, gnutls-devel, gnutls-devel-32bit, gnutls-x86
Products:
SLE-DEBUGINFO 10-SP3 (i386, s390x, x86_64)
SLE-SERVER 10-SP3-LTSS (i386, s390x, x86_64)
Comment 11 Swamp Workflow Management 2014-03-03 21:01:34 UTC 
Update released for: gnutls, gnutls-debuginfo, gnutls-debugsource, libgnutls-devel, libgnutls-extra-devel, libgnutls-extra26, libgnutls26, libgnutls26-32bit, libgnutls26-64bit, libgnutls26-x86
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-HAE 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 12 Swamp Workflow Management 2014-03-03 21:03:23 UTC 
Update released for: gnutls, gnutls-debuginfo, gnutls-debugsource, libgnutls-devel, libgnutls-extra-devel, libgnutls-extra26, libgnutls26, libgnutls26-32bit, libgnutls26-x86
Products:
SLE-DEBUGINFO 11-SP2 (i386, s390x, x86_64)
SLE-SERVER 11-SP2-LTSS (i386, s390x, x86_64)
Comment 13 Swamp Workflow Management 2014-03-03 21:04:29 UTC 
Update released for: gnutls, gnutls-debuginfo, gnutls-debugsource, libgnutls-devel, libgnutls-extra-devel, libgnutls-extra26, libgnutls26
Products:
SLE-DEBUGINFO 11-SP1-TERADATA (x86_64)
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 14 Swamp Workflow Management 2014-03-03 21:04:50 UTC 
Update released for: gnutls, gnutls-debuginfo, gnutls-devel
Products:
SLE-DEBUGINFO 10-SP3-TERADATA (x86_64)
SLE-SERVER 10-SP3-TERADATA (x86_64)
Comment 15 Swamp Workflow Management 2014-03-04 00:04:46 UTC 
SUSE-SU-2014:0319-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (critical)
Bug References: 835760,865804,865993
CVE References: CVE-2009-5138,CVE-2014-0092
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    gnutls-2.4.1-24.39.49.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    gnutls-2.4.1-24.39.49.1
SUSE Linux Enterprise Server 11 SP3 (src):    gnutls-2.4.1-24.39.49.1
SUSE Linux Enterprise High Availability Extension 11 SP3 (src):    gnutls-2.4.1-24.39.49.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    gnutls-2.4.1-24.39.49.1
Comment 16 Swamp Workflow Management 2014-03-04 00:06:44 UTC 
SUSE-SU-2014:0320-1: An update that solves 9 vulnerabilities and has one errata is now available.

Category: security (critical)
Bug References: 536809,554084,659128,739898,753301,754223,802651,821818,865804,865993
CVE References: CVE-2009-5138,CVE-2011-4108,CVE-2012-0390,CVE-2012-1569,CVE-2012-1573,CVE-2013-0169,CVE-2013-1619,CVE-2013-2116,CVE-2014-0092
Sources used:
SUSE Linux Enterprise Server 10 SP3 LTSS (src):    gnutls-1.2.10-13.38.1
Comment 17 Swamp Workflow Management 2014-03-04 00:07:09 UTC 
SUSE-SU-2014:0321-1: An update that solves one vulnerability and has one errata is now available.

Category: security (critical)
Bug References: 865804,865993
CVE References: CVE-2014-0092
Sources used:
SUSE Linux Enterprise Server 10 SP4 LTSS (src):    gnutls-1.2.10-13.38.1
Comment 18 Swamp Workflow Management 2014-03-04 00:08:16 UTC 
SUSE-SU-2014:0322-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (critical)
Bug References: 760265,802651,821818,835760,865804,865993
CVE References: CVE-2009-5138,CVE-2013-1619,CVE-2013-2116,CVE-2014-0092
Sources used:
SUSE Linux Enterprise Server 11 SP1 LTSS (src):    gnutls-2.4.1-24.39.49.1
Comment 19 Swamp Workflow Management 2014-03-04 00:08:52 UTC 
SUSE-SU-2014:0323-1: An update that solves one vulnerability and has two fixes is now available.

Category: security (critical)
Bug References: 835760,865804,865993
CVE References: CVE-2014-0092
Sources used:
SUSE Linux Enterprise Server 11 SP2 LTSS (src):    gnutls-2.4.1-24.39.49.1
Comment 20 Marcus Meissner 2014-03-04 15:53:21 UTC 
all released
Comment 21 Swamp Workflow Management 2014-03-25 14:46:33 UTC 
Update released for: gnutls, gnutls-debuginfo, gnutls-debugsource, libgnutls-devel, libgnutls-extra-devel, libgnutls-extra26, libgnutls26, libgnutls26-32bit, libgnutls26-x86
Products:
SUSE-MANAGER 1.7 (x86_64)
Comment 22 Swamp Workflow Management 2014-03-25 18:05:11 UTC 
SUSE-SU-2014:0445-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (important)
Bug References: 835760,865804,865993
CVE References: CVE-2009-5138,CVE-2014-0092
Sources used:
SUSE Manager 1.7 for SLE 11 SP2 (src):    gnutls-2.4.1-24.39.49.1