Lucene search

[email protected]NVD:CVE-2012-1573

HistoryMar 26, 2012 - 7:55 p.m.

CVE-2012-1573

2012-03-2619:55:01

CWE-310

[email protected]

web.nvd.nist.gov

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

AI Score

Confidence

High

0.956 High

EPSS

Percentile

99.4%

JSON

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

Affected configurations

NVD

Node

gnugnutlsRange≤2.12.16

gnugnutlsMatch2.0.0

gnugnutlsMatch2.0.1

gnugnutlsMatch2.0.2

gnugnutlsMatch2.0.3

gnugnutlsMatch2.0.4

gnugnutlsMatch2.1.0

gnugnutlsMatch2.1.1

gnugnutlsMatch2.1.2

gnugnutlsMatch2.1.3

gnugnutlsMatch2.1.4

gnugnutlsMatch2.1.5

gnugnutlsMatch2.1.6

gnugnutlsMatch2.1.7

gnugnutlsMatch2.1.8

gnugnutlsMatch2.2.0

gnugnutlsMatch2.2.1

gnugnutlsMatch2.2.2

gnugnutlsMatch2.2.3

gnugnutlsMatch2.2.4

gnugnutlsMatch2.2.5

gnugnutlsMatch2.3.0

gnugnutlsMatch2.3.1

gnugnutlsMatch2.3.2

gnugnutlsMatch2.3.3

gnugnutlsMatch2.3.4

gnugnutlsMatch2.3.5

gnugnutlsMatch2.3.6

gnugnutlsMatch2.3.7

gnugnutlsMatch2.3.8

gnugnutlsMatch2.3.9

gnugnutlsMatch2.3.10

gnugnutlsMatch2.3.11

gnugnutlsMatch2.4.0

gnugnutlsMatch2.4.1

gnugnutlsMatch2.4.2

gnugnutlsMatch2.4.3

gnugnutlsMatch2.5.0

gnugnutlsMatch2.6.0

gnugnutlsMatch2.6.1

gnugnutlsMatch2.6.2

gnugnutlsMatch2.6.3

gnugnutlsMatch2.6.4

gnugnutlsMatch2.6.5

gnugnutlsMatch2.6.6

gnugnutlsMatch2.7.4

gnugnutlsMatch2.8.0

gnugnutlsMatch2.8.1

gnugnutlsMatch2.8.2

gnugnutlsMatch2.8.3

gnugnutlsMatch2.8.4

gnugnutlsMatch2.8.5

gnugnutlsMatch2.8.6

gnugnutlsMatch2.10.0

gnugnutlsMatch2.10.1

gnugnutlsMatch2.10.2

gnugnutlsMatch2.10.3

gnugnutlsMatch2.10.4

gnugnutlsMatch2.10.5

gnugnutlsMatch2.12.0

gnugnutlsMatch2.12.1

gnugnutlsMatch2.12.2

gnugnutlsMatch2.12.3

gnugnutlsMatch2.12.4

gnugnutlsMatch2.12.5

gnugnutlsMatch2.12.6

gnugnutlsMatch2.12.6.1

gnugnutlsMatch2.12.7

gnugnutlsMatch2.12.8

gnugnutlsMatch2.12.9

gnugnutlsMatch2.12.10

gnugnutlsMatch2.12.11

gnugnutlsMatch2.12.12

gnugnutlsMatch2.12.13

gnugnutlsMatch2.12.14

gnugnutlsMatch2.12.15

Node

gnugnutlsMatch3.0

gnugnutlsMatch3.0.0

gnugnutlsMatch3.0.1

gnugnutlsMatch3.0.2

gnugnutlsMatch3.0.3

gnugnutlsMatch3.0.4

gnugnutlsMatch3.0.5

gnugnutlsMatch3.0.6

gnugnutlsMatch3.0.7

gnugnutlsMatch3.0.8

gnugnutlsMatch3.0.9

gnugnutlsMatch3.0.10

gnugnutlsMatch3.0.11

gnugnutlsMatch3.0.12

gnugnutlsMatch3.0.13

gnugnutlsMatch3.0.14

References

archives.neohapsis.com/archives/bugtraq/2012-03/0099.html

article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910

article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912

blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/

git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=422214868061370aeeb0ac9cd0f021a5c350a57d

git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185

lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html

lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html

lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

osvdb.org/80259

rhn.redhat.com/errata/RHSA-2012-0429.html

rhn.redhat.com/errata/RHSA-2012-0488.html

rhn.redhat.com/errata/RHSA-2012-0531.html

secunia.com/advisories/48488

secunia.com/advisories/48511

secunia.com/advisories/48596

secunia.com/advisories/48712

secunia.com/advisories/57260

www.debian.org/security/2012/dsa-2441

www.gnu.org/software/gnutls/security.html

www.mandriva.com/security/advisories?name=MDVSA-2012:040

www.openwall.com/lists/oss-security/2012/03/21/4

www.openwall.com/lists/oss-security/2012/03/21/5

www.securityfocus.com/bid/52667

www.securitytracker.com/id?1026828

www.ubuntu.com/usn/USN-1418-1

bugzilla.redhat.com/show_bug.cgi?id=805432

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

AI Score

Confidence

High

0.956 High

EPSS

Percentile

99.4%

JSON

Related for NVD:CVE-2012-1573

cve1 nessus27 fedora4 prion1 openvas31 debiancve1 cvelist1 checkpoint_advisories1 veracode1 ubuntucve1 debian1 freebsd1 centos2 oraclelinux2 ubuntu1 amazon1 redhat4 gentoo1 slackware1 suse1 vmware2