Alerts This Week
Warning Icon 1 664
Alerts This Week
Warning Icon 1 664

Slackware: 2013-287-03 Moderate: Gnutls Remote Timing Threat

slackware
Calendar Grey October 15, 2013
Dist Slackware Esm H88
A security update for GnuTLS in Slackware mitigates potential vulnerabilities from timing attacks and resolves some minor bugs.
New gnutls packages are available for Slackware 12.1, 12.2, 13.0, 13.1, and 13.37 to fix security issues

Summary

Here are the details from the Slackware 13.37 ChangeLog: patches/packages/gnutls-2.10.5-i486-2_slack13.37.txz: Rebuilt. [Updated to the correct version to fix fetching the "latest" from gnu.org] This update prevents a side-channel attack which may allow remote attackers to conduct distinguishing attacks and plaintext recovery attacks using statistical analysis of timing data for crafted packets. Other minor security issues are patched as well. Thanks to mancha for backporting these patches. For more information, see: https://www.cve.org/CVERecord?id=CVE-2011-4128 https://www.cve.org/CVERecord?id=CVE-2012-1569 https://www.cve.org/CVERecord?id=CVE-2012-1573 https://www.cve.org/CVERecord?id=CVE-2013-1619 https://www.cve.org/CVERecord?id=CVE-2013-2116 (* Security fix *)

Where Find New Packages

Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 12.1: ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/gnutls-2.8.4-i486-2_slack12.1.tgz
Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/gnutls-2.8.4-i486-2_slack12.2.tgz
Updated package for Slackware 13.0:
Updated package for Slackware x86_64 13.0:
Updated package for Slackware 13.1:
Updated package for Slackware x86_64 13.1:
Updated package for Slackware 13.37:
Updated package for Slackware x86_64 13.37:

MD5 Signatures

Slackware 12.1 package: b1befa86737a2451146dd108eb58b9a9 gnutls-2.8.4-i486-2_slack12.1.tgz
Slackware 12.2 package: 7ea0f267149d76ccdcca1206027e664f gnutls-2.8.4-i486-2_slack12.2.tgz
Slackware 13.0 package: 2c102969a15b8a66e79ec4d07821faf7 gnutls-2.8.4-i486-2_slack13.0.txz
Slackware x86_64 13.0 package: 501b5709da4ff494a3ecdfee74187281 gnutls-2.8.4-x86_64-2_slack13.0.txz
Slackware 13.1 package: a7d101cd7fc47cf9e4e0f15406ca29fd gnutls-2.8.6-i486-2_slack13.1.txz
Slackware x86_64 13.1 package: 65a234fe93b46c7ea29799ffc3e4f25e gnutls-2.8.6-x86_64-2_slack13.1.txz
Slackware 13.37 package: 9cf8770560e17d1d57267cb05bf3badd gnutls-2.10.5-i486-2_slack13.37.txz
Slackware x86_64 13.37 package: 349f7f77e29612b679522a4a199c03fa gnutls-2.10.5-x86_64-2_slack13.37.txz

Severity
important
Lowest
Low
Medium
High
Critical

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg gnutls-2.10.5-i486-2_slack13.37.txz

Related News

Your message here