PT-2004-3423 · Gnu · Gnutls

Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-2531

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GnuTLS version 1.0.16

Description The issue concerns X.509 Certificate Signature Verification in the GnuTLS library, allowing remote attackers to cause a denial of service by consuming CPU resources. This can be achieved through certificates that contain long chains and are signed with large RSA keys.

Recommendations For GnuTLS version 1.0.16, consider updating to a newer version that addresses this issue, as the current version allows for potential denial of service attacks through specifically crafted certificates. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2004-2531

Produtos afetados

Gnutls

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2004-2531 · Nota de Segurança
• http://hornik.sk/SA/SA-20040802.txt · Aviso do Fabricante
• http://lists.gnupg.org/pipermail/gnutls-dev/2004-August/000703.html · Nota
• http://securitytracker.com/id?1010838 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16858 · Nota
• http://secunia.com/advisories/12156 · Aviso do Fabricante
• http://osvdb.org/8278 · Correção
• http://securityfocus.com/bid/10839 · Correção