Phys.org: Programmer Nikos Mavrogiannopoulos who works for Red Hat, has discovered a major security problem with the Linux operating system—a bug that could allow a hacker to create a certificate that could bypass the normal authenticity checks. Red Hat sent out an immediate alert and suggests all those who use its product update their software with a fix they’ve made available.
Officially known as CVE-2014-0092, the bugappears to be a simple programming error—one that has been in a part of the Linux operating system for over a decade. More specifically, the bug involves GnuTLS‘s (a library of functions used for processing certificate requests) validation of X509 certificates. In many respects, the error appears to be similar to the “goto fail” security problem that cropped up in iOS and OS X recently.
