CVE-2012-1573

Severity

50%

Complexity

99%

Confidentiality

48%

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

CVSS 2.0 Base Score 5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P).

Overview

Type

GNU

First reported 12 years ago

2012-03-26 19:55:00

Last updated 7 years ago

2018-01-18 02:29:00

Affected Software

GNU GnuTLS 2.0.0

2.0.0

GNU GnuTLS 2.0.1

2.0.1

GNU GnuTLS 2.0.2

2.0.2

GNU GnuTLS 2.0.3

2.0.3

GNU GnuTLS 2.0.4

2.0.4

GNU GnuTLS 2.1.0

2.1.0

GNU GnuTLS 2.1.1

2.1.1

GNU GnuTLS 2.1.2

2.1.2

GNU GnuTLS 2.1.3

2.1.3

GNU GnuTLS 2.1.4

2.1.4

GNU GnuTLS 2.1.5

2.1.5

GNU GnuTLS 2.1.6

2.1.6

GNU GnuTLS 2.1.7

2.1.7

GNU GnuTLS 2.1.8

2.1.8

GNU GnuTLS 2.2.0

2.2.0

GNU GnuTLS 2.2.1

2.2.1

GNU GnuTLS 2.2.2

2.2.2

GNU GnuTLS 2.2.3

2.2.3

GNU GnuTLS 2.2.4

2.2.4

GNU GnuTLS 2.2.5

2.2.5

GNU GnuTLS 2.3.0

2.3.0

GNU GnuTLS 2.3.1

2.3.1

GNU GnuTLS 2.3.2

2.3.2

GNU GnuTLS 2.3.3

2.3.3

GNU GnuTLS 2.3.4

2.3.4

GNU GnuTLS 2.3.5

2.3.5

GNU GnuTLS 2.3.6

2.3.6

GNU GnuTLS 2.3.7

2.3.7

GNU GnuTLS 2.3.8

2.3.8

GNU GnuTLS 2.3.9

2.3.9

GNU GnuTLS 2.3.10

2.3.10

GNU GnuTLS 2.3.11

2.3.11

GNU GnuTLS 2.4.0

2.4.0

GNU GnuTLS 2.4.1

2.4.1

GNU GnuTLS 2.4.2

2.4.2

GNU GnuTLS 2.4.3

2.4.3

GNU GnuTLS 2.5.0

2.5.0

GNU GnuTLS 2.6.0

2.6.0

GNU GnuTLS 2.6.1

2.6.1

GNU GnuTLS 2.6.2

2.6.2

GNU GnuTLS 2.6.3

2.6.3

GNU GnuTLS 2.6.4

2.6.4

GNU GnuTLS 2.6.5

2.6.5

GNU GnuTLS 2.6.6

2.6.6

GNU GnuTLS 2.7.4

2.7.4

GNU GnuTLS 2.8.0

2.8.0

GNU GnuTLS 2.8.1

2.8.1

GNU GnuTLS 2.8.2

2.8.2

GNU GnuTLS 2.8.3

2.8.3

GNU GnuTLS 2.8.4

2.8.4

GNU GnuTLS 2.8.5

2.8.5

GNU GnuTLS 2.8.6

2.8.6

GNU GnuTLS 2.10.0

2.10.0

GNU GnuTLS 2.10.1

2.10.1

GNU GnuTLS 2.10.2

2.10.2

GNU GnuTLS 2.10.3

2.10.3

GNU GnuTLS 2.10.4

2.10.4

GNU GnuTLS 2.10.5

2.10.5

GNU GnuTLS 2.12.0

2.12.0

GNU GnuTLS 2.12.1

2.12.1

GNU GnuTLS 2.12.2

2.12.2

GNU GnuTLS 2.12.3

2.12.3

GNU GnuTLS 2.12.4

2.12.4

GNU GnuTLS 2.12.5

2.12.5

GNU GnuTLS 2.12.6

2.12.6

GNU GnuTLS 2.12.6.1

2.12.6.1

GNU GnuTLS 2.12.7

2.12.7

GNU GnuTLS 2.12.8

2.12.8

GNU GnuTLS 2.12.9

2.12.9

GNU GnuTLS 2.12.10

2.12.10

GNU GnuTLS 2.12.11

2.12.11

GNU GnuTLS 2.12.12

2.12.12

GNU GnuTLS 2.12.13

2.12.13

GNU GnuTLS 2.12.14

2.12.14

GNU GnuTLS 2.12.15

2.12.15

GNU GnuTLS

GNU TLS 3.0

3.0

GNU GnuTLS 3.0.0

3.0.0

GNU GnuTLS 3.0.1

3.0.1

GNU GnuTLS 3.0.2

3.0.2

GNU GnuTLS 3.0.3

3.0.3

GNU GnuTLS 3.0.4

3.0.4

GNU GnuTLS 3.0.5

3.0.5

GNU GnuTLS 3.0.6

3.0.6

GNU GnuTLS 3.0.7

3.0.7

GNU GnuTLS 3.0.8

3.0.8

GNU GnuTLS 3.0.9

3.0.9

GNU GnuTLS 3.0.10

3.0.10

GNU GnuTLS 3.0.11

3.0.11

GNU GnuTLS 3.0.12

3.0.12

GNU GnuTLS 3.0.13

3.0.13

GNU GnuTLS 3.0.14

3.0.14

References

20120320 Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1

[gnutls-devel] 20120302 gnutls 2.12.16

[gnutls-devel] 20120302 gnutls 3.0.15

http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/

http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commit;h=422214868061370aeeb0ac9cd0f021a5c350a57d

http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commit;h=b495740f2ff66550ca9395b3fda3ea32c3acb185

FEDORA-2012-4569

FEDORA-2012-4578

SUSE-SU-2014:0320

80259

RHSA-2012:0429

RHSA-2012:0488

RHSA-2012:0531

48488

48511

48596

48712

57260

DSA-2441

http://www.gnu.org/software/gnutls/security.html

Vendor Advisory

MDVSA-2012:040

[oss-security] 20120321 CVE request: GnuTLS TLS record handling issue / MU-201202-01

[oss-security] 20120321 Re: CVE request: GnuTLS TLS record handling issue / MU-201202-01

52667

1026828

USN-1418-1

https://bugzilla.redhat.com/show_bug.cgi?id=805432

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.