PT-2013-5040 · Gnu · Gnutls

Tomas Hoger · Published 2013-11-19 · Updated 2018-10-30 · CVE-2013-4487

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions 3.1.x through 3.1.15 GnuTLS versions 3.2.x through 3.2.5

Description The issue is caused by an off-by-one error in the dane raw tlsa function of the DANE library (libdane) in GnuTLS. This error allows remote servers to cause a denial of service (memory corruption) by sending a response with more than four DANE entries.

Recommendations For GnuTLS versions 3.1.x through 3.1.15, update to version 3.1.16 or later. For GnuTLS versions 3.2.x through 3.2.5, update to version 3.2.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2013-4487

Affected Products

Gnutls

References · 8

• 🔥 https://gitorious.org/gnutls/gnutls/commit/0dd5529509e46b11d5c0f3f26f99294e0e5fa6dc · Exploit
• http://openwall.com/lists/oss-security/2013/10/31/4 · Patch
• https://cve.org/CVERecord?id=CVE-2013-4487 · Security Note
• https://ubuntu.com/security/CVE-2013-4487 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4487 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00064.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4487 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/10/31 · Note