SB2013102802 - Gentoo update for GnuTLS

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Cryptographic issues (CVE-ID: CVE-2013-1619)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

2) Input validation error (CVE-ID: CVE-2013-2116)

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (buffer over-read and crash) via a crafted padding length.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/201310-18