PT-2017-16439 · Gnu+3 · Gnutls+3

Nikos Mavrogiannopoulos · Publicado 2017-01-11 · Atualizado 2018-10-30 · CVE-2017-5334

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.3.26 GnuTLS versions 3.5.x prior to 3.5.8

Description A double free vulnerability exists in the gnutls x509 ext import proxy function, allowing remote attackers to have an unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.

Recommendations For GnuTLS versions prior to 3.3.26, update to version 3.3.26 or later. For GnuTLS versions 3.5.x prior to 3.5.8, update to version 3.5.8 or later.

Exploit

Correção

Double Free

Enumeração de Fraquezas

CWE-415

Identificadores relacionados

CESA-2017_2292

CVE-2017-5334

MGASA-2017-0053

RHSA-2017:2292

RHSA-2017_2292

USN-3183-1

Produtos afetados

Centos

Gnutls

Red Hat

Ubuntu

Referências · 52

• 🔥 https://github.com/cujanovic/CVE-2016-8610-PoC · Exploit
• https://ubuntu.com/security/CVE-2016-8610 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2017-02/msg00005.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5337 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2017-5334 · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2017-August/023758.html · Nota
• https://lists.centos.org/pipermail/centos-cr-announce/2017-August/004178.html · Nota
• http://securityfocus.com/bid/95370 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5335 · Nota de Segurança
• https://lists.centos.org/pipermail/centos-cr-announce/2017-August/030448.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-5334 · Aviso do Fabricante
• https://gnutls.org/security.html#GNUTLS-SA-2017-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5334 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:2292 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-5336 · Aviso do Fabricante