{"id":15312,"date":"2014-06-05T01:36:24","date_gmt":"2014-06-05T05:36:24","guid":{"rendered":"https:\/\/webhostinggeeks.com\/blog\/?p=15312"},"modified":"2021-10-19T06:51:27","modified_gmt":"2021-10-19T10:51:27","slug":"risks-from-gnutls-hello","status":"publish","type":"post","link":"https:\/\/webhostinggeeks.com\/blog\/risks-from-gnutls-hello\/","title":{"rendered":"Are Secure Servers, Applications Really at Risk from GnuTLS “Hello” Vulnerability?"},"content":{"rendered":"

Security experts and researchers have found a risky vulnerability in GnuTLS, a secure communications library for SSL, TLS and DTLS protocols and associated technologies, which has experts frantically urging users to update GnuTLS.\u00a0According to a\u00a0bug description<\/a>, posted by Bugzilla\u00a0Red Hat, \u201ca flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS\/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS\/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code.\u201d<\/em><\/p>\n

<\/p>\n

\"redhat\"<\/a><\/p>\n

The flaw in question, according to thewhir.com<\/a>,\u00a0“was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS\/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS\/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code.\u201d<\/p>\n

In\u00a0a blog post<\/a> from radare, a company that creates reverse engineering frameworks, it showed that its r2 software could be used to exploit the GnuTLS vulnerability. radare’s recommendtion is to \u00a0update GnuTLS to version 3.1.25, 3.2.15 or 3.3.4.<\/p>\n

“In order to test that vulnerability I choose to run a 32bit\u00a0VoidLinux<\/a>\u00a0Virtualbox VM, fetched the r2 source from git, and executed the GnuTLS binaries against the system libs. This way, switching between the fixed and vulnerable executions can be done by changing the\u00a0LD_LIBRARY_PATH<\/code>\u00a0environment.”<\/p>\n

“It’s recommended to use r2 from git: read\u00a0this<\/a>\u00a0post to install r2 in your system.”<\/p>\n

“A quick check on all the packages that depend on GnuTLS shows some hints of which client software is vulnerable to this issue.”<\/p>\n

\"radare\"<\/a><\/p>\n

“GnuTLS credits Joonas Kuorilehto of Codenomicon as the individual who originally discovered the vulnerability. Codenomicon employees were among those that found\u00a0the Heartbleed bug<\/a>, a recent and devastating vulnerability in OpenSSL that presented risks for many high-profile sites, causing millions to change their web account passwords.”<\/p>\n

“GnuTLS is an open-source transport-layer security library similar to OpenSSL, but less popular. Yet it is still widely used. It is shipped by default in Red Hat, Ubuntu and Debian, and more than 200 Linux software packages depend on it for SSL\/TLS.”<\/p>\n

“With the OpenSSL vulnerability in recent memory, administrators will want to take a similar level of diligence to ensure that GnuTLS doesn\u2019t provide a way for hackers to interfere with their servers and applications.”<\/p>\n

The GnuTLS chief developer and Red Hat engineer, Nikos Mavrogiannopoulos, released updates for the library that fixed the problems with GnuTLS versions\u00a03.1.25<\/a>,\u00a03.2.15<\/a>, and\u00a03.3.3<\/a>.<\/p>\n

ZDNet writer, Liam Tung, speaking on this bug, relays<\/a> that “while it’s thought the library is used by around 200 operating systems and applications, arguably many of them were\u00a0not likely targets for a man-in-the-middle attack.”<\/p>\n

This is not the first time ZDNet has mentioned the bugs in GnuTLS. In a March 6th article<\/a> from earlier this year, Steven J. Vaughan-Nichols wrote:<\/p>\n

“According to some reports you’d think the security sky was falling. Yes,\u00a0GnuTLS<\/a>, an open-source “secure” communications library that implements \\Secure-Socket Layer (SSL) and Transport Layer Security (TLS), has serious flaws. The good news? Almost no one uses it.\u00a0OpenSSL<\/a>\u00a0has long been everyone’s favorite open-source security library of choice.”<\/p>\n

Red Hat discovered the latest in a long-series of GnuTLS bugs<\/a>.<\/p>\n

“Latest? Yes, latest.”<\/p>\n

“You see, GnuTLS has long been regarded as being a poor SSL\/TLS security library. A 2008 message on the OpenLDAP mailing list had “GnuTLS considered harmful<\/a>” as its subject \u2014 which summed it up nicely.”<\/p>\n

At the end of his article, he looks to kill the issues:<\/p>\n

“No one should be using GnuTLS. There are far better security programs out there starting with the far more popular OpenSSL. If for some reason you must use GnuTLS for now, either\u00a0upgrade to the latest GnuTLS version (3.2.12)\u00a0or\u00a0apply the GnuTLS 2.12.x patch<\/a>. Oh, and developers? Start weaning your programs from GnuTLS, you, and your users, will be glad you did.”<\/p>\n

Vaughan-Nichols’ news from two months ago begs the question, was the bug worse than first thought? Was the problem ignored? Is it really as bad as people have said or did the Heartbleed bug scare the hell out of security experts and programmers, getting faster action on GnuTLS? Is it another case of the sky is falling but no one really wants to be the one to look up and see? Whatever the answer, is there really any bug that can be ignored?<\/p>\n

Top image \u00a9GL Stock Images<\/p>\n","protected":false},"excerpt":{"rendered":"

Security experts and researchers have found a risky vulnerability in GnuTLS, a secure communications library for SSL, TLS and DTLS protocols and associated technologies, which has experts frantically urging users…<\/p>\n","protected":false},"author":13,"featured_media":15330,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":0,"footnotes":""},"categories":[9,11],"tags":[7193,7196,7192,7194,26,102,110],"class_list":["post-15312","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-issues","category-web-hosting-news","tag-bugs","tag-bugzilla","tag-gnutls","tag-programming","tag-redhat","tag-security","tag-ssl"],"views":157,"_links":{"self":[{"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/posts\/15312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/users\/13"}],"replies":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/comments?post=15312"}],"version-history":[{"count":0,"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/posts\/15312\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/media\/15330"}],"wp:attachment":[{"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/media?parent=15312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/categories?post=15312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webhostinggeeks.com\/blog\/wp-json\/wp\/v2\/tags?post=15312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}