CVE-2012-1569: Medium severity GNU GnuTLS vulnerability
libtasn1 version 2.12 was released fixing the following issue:
- Corrected DER decoding issue (reported by Matthew Hall). Added self check to detect the problem, see tests/Testoverflow.c. This problem can lead to at least remotely triggered crashes, see further analysis on the libtasn1 mailing list.
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53
Upstream and few limited details are available at:
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54
The behavior of asn1getlengthder was changed to protect against accidental incorrect use, if though it was previously "working properly and as documented".
Other sources
The asn1getlengthder function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1569?
CVE-2012-1569 has been classified as having high severity due to potential remote crashes.
How do I fix CVE-2012-1569?
To fix CVE-2012-1569, you should upgrade the affected GNU GnuTLS and libtasn1 versions to versions 2.12 or higher.
What impacts does CVE-2012-1569 have on system security?
CVE-2012-1569 can lead to denial of service attacks as it may cause crashes during DER decoding.
Which versions of GNU GnuTLS are affected by CVE-2012-1569?
CVE-2012-1569 affects multiple versions of GNU GnuTLS up to 3.0.15.
Is CVE-2012-1569 a local or remote vulnerability?
CVE-2012-1569 is considered a remote vulnerability as it can be exploited from a remote location.