PT-2018-2898 · Gnu+4 · Libtasn1+4
Publicado
2018-08-12
·
Atualizado
2024-06-15
·
CVE-2018-1000654
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libtasn1 versions 4.12 through 4.13
Description
The issue is related to a denial of service (DoS) in the
asn1 expand object id(p tree) function, which can cause CPU usage to reach 100% when parsing a crafted file with the asn1Parser. This can lead to the program being killed after a long time. The vulnerability is exploitable via parsing a maliciously crafted file and is associated with resource management errors.Recommendations
For libtasn1 versions 4.12 through 4.13, consider disabling the
asn1 expand object id(p tree) function as a temporary workaround until a patch is available. Restrict access to the asn1Parser to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Suse
Ubuntu
Libtasn1