CVE-2008-2377: Buffer Overflow

Published Aug 8, 2008

Updated

Use-after-free vulnerability in the gnutlshandshakehashbuffersclear function in lib/gnutlshandshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data that is improperly used when the peer calls gnutlshandshake within a normal session, leading to attempted access to a deallocated libgcrypt handle.

Affected Software

6 affected components

GNU GnuTLS=2.3.5

GNU GnuTLS=2.3.8

GNU GnuTLS=2.3.9

GNU GnuTLS=2.4.0

GNU GnuTLS=2.3.7

GNU GnuTLS=2.3.6

Remediation

Patch Available

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947

Event History

Aug 8, 2008

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2377?

CVE-2008-2377 is considered a high-severity vulnerability due to its potential to cause denial of service and possibly execute arbitrary code.

How do I fix CVE-2008-2377?

To fix CVE-2008-2377, upgrade GnuTLS to version 2.4.1 or later as it includes patches that resolve this vulnerability.

What versions of GnuTLS are affected by CVE-2008-2377?

CVE-2008-2377 affects GnuTLS versions 2.3.5 through 2.4.0.

Can CVE-2008-2377 lead to remote code execution?

Yes, CVE-2008-2377 can potentially allow remote attackers to execute arbitrary code under certain conditions.

What implications does CVE-2008-2377 have for users of affected GnuTLS versions?

Users of affected GnuTLS versions may experience crashes and potential exploits from remote attackers taking advantage of this vulnerability.