PT-2004-3423 · Gnu · Gnutls

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2531

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GnuTLS version 1.0.16

Description The issue concerns X.509 Certificate Signature Verification in the GnuTLS library, allowing remote attackers to cause a denial of service by consuming CPU resources. This can be achieved through certificates that contain long chains and are signed with large RSA keys.

Recommendations For GnuTLS version 1.0.16, consider updating to a newer version that addresses this issue, as the current version allows for potential denial of service attacks through specifically crafted certificates. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2004-2531

Affected Products

Gnutls

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2004-2531 · Security Note
• http://hornik.sk/SA/SA-20040802.txt · Vendor Advisory
• http://securitytracker.com/id?1010838 · Vendor Advisory
• http://secunia.com/advisories/12156 · Vendor Advisory
• http://osvdb.org/8278 · Patch
• http://securityfocus.com/bid/10839 · Patch
• http://lists.gnupg.org/pipermail/gnutls-dev/2004-August/000703.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16858 · Note