PT-2013-5029 · Gnu · Gnutls

Marcus Meissner · Published 2013-11-19 · Updated 2013-11-30 · CVE-2013-4466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions 3.1.x through 3.1.14 GnuTLS versions 3.2.x through 3.2.4

Description The issue is related to a buffer overflow in the dane query tlsa function within the DANE library (libdane) of GnuTLS. This allows remote servers to cause a denial of service, resulting in memory corruption, by sending a response that contains more than four DANE entries.

Recommendations For GnuTLS versions 3.1.x through 3.1.14, update to version 3.1.15 or later. For GnuTLS versions 3.2.x through 3.2.4, update to version 3.2.5 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2013-4466

MGASA-2013-0354

Affected Products

Gnutls

References · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4466 · Vendor Advisory
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7050 · Patch
• http://gnutls.org/security.html#GNUTLS-SA-2013-3 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0354.html · Security Note
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7049 · Patch
• https://lists.fedoraproject.org/pipermail/package-announce/2013-October/119788.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4466 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-4466 · Security Note
• https://ubuntu.com/security/CVE-2013-4466 · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=11561 · Note
• http://lists.gnutls.org/pipermail/gnutls-help/2013-October/003262.html · Note
• http://lists.gnutls.org/pipermail/gnutls-help/2013-October/003250.html · Note
• http://lists.gnutls.org/pipermail/gnutls-help/2013-August/003216.html · Note
• http://openwall.com/lists/oss-security/2013/10/25/2 · Note