PT-2013-5029 · Gnu · Gnutls

Marcus Meissner · Publicado 2013-11-19 · Atualizado 2013-11-30 · CVE-2013-4466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions 3.1.x through 3.1.14 GnuTLS versions 3.2.x through 3.2.4

Description The issue is related to a buffer overflow in the dane query tlsa function within the DANE library (libdane) of GnuTLS. This allows remote servers to cause a denial of service, resulting in memory corruption, by sending a response that contains more than four DANE entries.

Recommendations For GnuTLS versions 3.1.x through 3.1.14, update to version 3.1.15 or later. For GnuTLS versions 3.2.x through 3.2.4, update to version 3.2.5 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2013-4466

MGASA-2013-0354

Produtos afetados

Gnutls

Referências · 15

• https://bugs.mageia.org/show_bug.cgi?id=11561 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4466 · Aviso do Fabricante
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7050 · Correção
• http://lists.gnutls.org/pipermail/gnutls-help/2013-October/003262.html · Nota
• http://lists.gnutls.org/pipermail/gnutls-help/2013-October/003250.html · Nota
• http://gnutls.org/security.html#GNUTLS-SA-2013-3 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2013-0354.html · Nota de Segurança
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7049 · Correção
• https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119788.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2013-0354 · Aviso do Fabricante
• http://lists.gnutls.org/pipermail/gnutls-help/2013-August/003216.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4466 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2013-4466 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-4466 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/10/25/2 · Nota