CVE-2011-4128: Buffer Overflow
A flaw was reported [1] in the GnuTLS gnutlssessiongetdata() function, which could overflow a too-short buffer parameter allocated by the caller. The test which was to avoid such buffer overflows was not working. A malicious server could use this flaw in a vulnerable client to send a larger SessionTicket in the hope of overflowing the client.
Upstream has indicated that they are unaware of any client software that does not properly use the session resumption functions; clients that perform session resumption as documented [2] are not vulnerable.
[1] http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596 [2] http://www.gnu.org/s/gnutls/manual/htmlnode/Client-with-Resume-capability-example.html#Client-with-Resume-capability-example
Other sources
Buffer overflow in the gnutlssessiongetdata function in lib/gnutlssession.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4128?
The severity of CVE-2011-4128 is classified as high due to the potential for buffer overflow leading to system compromise.
How do I fix CVE-2011-4128?
To fix CVE-2011-4128, upgrade to GnuTLS version 2.12.14 or 3.0.7 or later versions.
What are the affected software versions for CVE-2011-4128?
Affected software versions for CVE-2011-4128 include GnuTLS versions from 2.12.0 to 2.12.13 and from 3.0.0 to 3.0.6.
Can CVE-2011-4128 be exploited remotely?
Yes, CVE-2011-4128 can be exploited by a malicious server targeting a vulnerable client.
What type of vulnerability is CVE-2011-4128?
CVE-2011-4128 is a buffer overflow vulnerability that occurs in the gnutls_session_get_data() function.