PT-2012-1119 · Gentoo+4 · Gentoo Linux+4

Matthew Hall · Published 2012-03-26 · Updated 2024-06-15 · CVE-2012-1573

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 3.0.15 GnuTLS versions prior to 2.12.18

Description The issue affects the gnutls package in Gentoo Linux, potentially compromising the confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. Specifically, gnutls cipher.c in libgnutls does not properly handle data encrypted with a block cipher, allowing remote attackers to cause a denial of service via a crafted record, such as a crafted GenericBlockCipher structure.

Recommendations For versions prior to 2.12.18, update to version 2.12.18 or later. For versions prior to 3.0.15, update to version 3.0.15 or later. As a temporary workaround, consider restricting access to the gnutls cipher.c function in libgnutls until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2015-09647

CESA-2012_0429

CVE-2012-1573

DSA-2441-1

OPENSUSE-SU-2024:10105-1

RHSA-2012:0428

RHSA-2012:0429

RHSA-2012:0531

RHSA-2012_0428

RHSA-2012_0429

Affected Products

Centos

Gentoo Linux

Gnutls

Red Hat

Suse

References · 58

• 🔥 http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns · Exploit
• http://debian.org/security/2012/dsa-2441 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10105-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09647 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:040 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1573 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-1573 · Vendor Advisory
• http://ubuntu.com/usn/USN-1418-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1573 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4128 · Security Note
• http://gnu.org/software/gnutls/security.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-0429.html · Vendor Advisory