Re: CVE Request - GnuTLS corrects flaw in certificate verification (3.1.x/3.2.x)

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Use CVE-2009-5138 for the

  https://gitorious.org/gnutls/gnutls/commit/c8dcbedd1fdc312f5b1a70fcfbc1afe235d800cd

issue. This says "Initialy reported by Daniel Kahn Gillmor on 9/1/2008" but
that seems to be a typo of 9/1/2009 (aka 2009-01-09), because the actual
report was in:

  http://lists.gnutls.org/pipermail/gnutls-devel/2009-January/002888.html


> https://bugzilla.redhat.com/show_bug.cgi?id=1069301

> This did not affect applications that used
> GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT verification flag, which instructs
> GnuTLS to allow root CA certificates to be version 1 certificates.
> This was set by e.g. gnutls-cli client application in GnuTLS versions
> affected by this bug.

Is this setting in gnutls-cli itself a vulnerability, because
GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT is an unsafe flag for any general-purpose
application? For example,

  http://lists.gnutls.org/pipermail/gnutls-devel/2009-January/002892.html

says:

  GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT

  This one is quite dangerous. It allows any intermediate V1 certificate
  to be used as a signer. This means that if I manage to get a CA to give
  me a V1 personal certificate, I can act as a CA if this flag is set.


(In other words, all three CVEs would have the same impact -- something
roughly like "allows remote attackers to have an unintended ability
to issue new certificates by using an arbitrary X.509 V1 certificate --
but two of the CVEs [CVE-2014-1959, CVE-2009-5138] have a root cause
of logic errors in flag operations, whereas the proposed third CVE has a
root cause of a hardcoded unsafe configuration choice in gnutls-cli.)

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTDs4QAAoJEKllVAevmvms6CMH/0tir5Aw5SnbdXqGgY02Nstv
40x7v2MOmjWGnt1Z7RYVs6oCK4Cht9TH+CPA2sHX59z3WqplP2cW4y65tOmBJoe6
va9yITRxP+U8qittNOjcRC3wmIrHG0DxqX9qMdmc88rx9aVryWq5aEz5VGtk1E1k
r/L8eF/fAL+Bl67/Vp0xthsciRcSJvuoAyUXnlzhvdRxCtgwG1v1yh5POpHZz5qR
8m3/4hN05xhVQjYrTzCc5NuoCyYm7gcQ57UjuIF5zwAcsrfnHEsGKotBfw/dEgc9
8z3le9HqAvQ/mGd782sikVSsZdkclzRHIfAScQ6Gplv7fgwsItu9/esJMl1EjT4=
=a0uN
-----END PGP SIGNATURE-----