PT-2009-1087 · Gnu · Gnutls
Miroslav Kratochvil
·
Publicado
2009-04-30
·
Atualizado
2024-02-09
·
CVE-2009-1415
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
GnuTLS versions prior to 2.6.6
Description
The issue concerns multiple vulnerabilities in the GnuTLS package that can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, in GnuTLS before version 2.6.6, the
lib/pk-libgcrypt.c file does not properly handle invalid DSA signatures. This can allow remote attackers to cause a denial of service, such as an application crash, and possibly have other unspecified impacts by using a malformed DSA key. This malformed key can trigger either the free of an uninitialized pointer or a double free.Recommendations
For versions prior to 2.6.6, update to version 2.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to
lib/pk-libgcrypt.c or disabling the handling of DSA signatures until a patch is available. Avoid using malformed DSA keys in the affected API endpoints until the issue is resolved.Exploit
Correção
Access of Uninitialized Pointer
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Gnutls