CVE-2012-1569
First published: Tue Mar 20 2012(Updated: )
libtasn1 version 2.12 was released fixing the following issue: - Corrected DER decoding issue (reported by Matthew Hall). Added self check to detect the problem, see tests/Test_overflow.c. This problem can lead to at least remotely triggered crashes, see further analysis on the libtasn1 mailing list. <a href="http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53">http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53</a> Upstream and few limited details are available at: <a href="http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54">http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54</a> The behavior of asn1_get_length_der was changed to protect against accidental incorrect use, if though it was previously "working properly and as documented".
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GnuTLS | <=3.0.15 | |
| GnuTLS | =1.0.16 | |
| GnuTLS | =1.0.17 | |
| GnuTLS | =1.0.18 | |
| GnuTLS | =1.0.19 | |
| GnuTLS | =1.0.20 | |
| GnuTLS | =1.0.21 | |
| GnuTLS | =1.0.22 | |
| GnuTLS | =1.0.23 | |
| GnuTLS | =1.0.24 | |
| GnuTLS | =1.0.25 | |
| GnuTLS | =1.1.13 | |
| GnuTLS | =1.1.14 | |
| GnuTLS | =1.1.15 | |
| GnuTLS | =1.1.16 | |
| GnuTLS | =1.1.17 | |
| GnuTLS | =1.1.18 | |
| GnuTLS | =1.1.19 | |
| GnuTLS | =1.1.20 | |
| GnuTLS | =1.1.21 | |
| GnuTLS | =1.1.22 | |
| GnuTLS | =1.1.23 | |
| GnuTLS | =1.2.0 | |
| GnuTLS | =1.2.1 | |
| GnuTLS | =1.2.2 | |
| GnuTLS | =1.2.3 | |
| GnuTLS | =1.2.4 | |
| GnuTLS | =1.2.5 | |
| GnuTLS | =1.2.6 | |
| GnuTLS | =1.2.7 | |
| GnuTLS | =1.2.8 | |
| GnuTLS | =1.2.8.1a1 | |
| GnuTLS | =1.2.9 | |
| GnuTLS | =1.2.10 | |
| GnuTLS | =1.2.11 | |
| GnuTLS | =1.3.0 | |
| GnuTLS | =1.3.1 | |
| GnuTLS | =1.3.2 | |
| GnuTLS | =1.3.3 | |
| GnuTLS | =1.3.4 | |
| GnuTLS | =1.3.5 | |
| GnuTLS | =1.4.0 | |
| GnuTLS | =1.4.1 | |
| GnuTLS | =1.4.2 | |
| GnuTLS | =1.4.3 | |
| GnuTLS | =1.4.4 | |
| GnuTLS | =1.4.5 | |
| GnuTLS | =1.5.0 | |
| GnuTLS | =1.5.1 | |
| GnuTLS | =1.5.2 | |
| GnuTLS | =1.5.3 | |
| GnuTLS | =1.5.4 | |
| GnuTLS | =1.5.5 | |
| GnuTLS | =1.6.0 | |
| GnuTLS | =1.6.1 | |
| GnuTLS | =1.6.2 | |
| GnuTLS | =1.6.3 | |
| GnuTLS | =1.7.0 | |
| GnuTLS | =1.7.1 | |
| GnuTLS | =1.7.2 | |
| GnuTLS | =1.7.3 | |
| GnuTLS | =1.7.4 | |
| GnuTLS | =1.7.5 | |
| GnuTLS | =1.7.6 | |
| GnuTLS | =1.7.7 | |
| GnuTLS | =1.7.8 | |
| GnuTLS | =1.7.9 | |
| GnuTLS | =1.7.10 | |
| GnuTLS | =1.7.11 | |
| GnuTLS | =1.7.12 | |
| GnuTLS | =1.7.13 | |
| GnuTLS | =1.7.14 | |
| GnuTLS | =1.7.15 | |
| GnuTLS | =1.7.16 | |
| GnuTLS | =1.7.17 | |
| GnuTLS | =1.7.18 | |
| GnuTLS | =1.7.19 | |
| GnuTLS | =2.0.0 | |
| GnuTLS | =2.0.1 | |
| GnuTLS | =2.0.2 | |
| GnuTLS | =2.0.3 | |
| GnuTLS | =2.0.4 | |
| GnuTLS | =2.1.0 | |
| GnuTLS | =2.1.1 | |
| GnuTLS | =2.1.2 | |
| GnuTLS | =2.1.3 | |
| GnuTLS | =2.1.4 | |
| GnuTLS | =2.1.5 | |
| GnuTLS | =2.1.6 | |
| GnuTLS | =2.1.7 | |
| GnuTLS | =2.1.8 | |
| GnuTLS | =2.2.0 | |
| GnuTLS | =2.2.1 | |
| GnuTLS | =2.2.2 | |
| GnuTLS | =2.2.3 | |
| GnuTLS | =2.2.4 | |
| GnuTLS | =2.2.5 | |
| GnuTLS | =2.3.0 | |
| GnuTLS | =2.3.1 | |
| GnuTLS | =2.3.2 | |
| GnuTLS | =2.3.3 | |
| GnuTLS | =2.3.4 | |
| GnuTLS | =2.3.5 | |
| GnuTLS | =2.3.6 | |
| GnuTLS | =2.3.7 | |
| GnuTLS | =2.3.8 | |
| GnuTLS | =2.3.9 | |
| GnuTLS | =2.3.10 | |
| GnuTLS | =2.3.11 | |
| GnuTLS | =2.4.0 | |
| GnuTLS | =2.4.1 | |
| GnuTLS | =2.4.2 | |
| GnuTLS | =2.4.3 | |
| GnuTLS | =2.5.0 | |
| GnuTLS | =2.6.0 | |
| GnuTLS | =2.6.1 | |
| GnuTLS | =2.6.2 | |
| GnuTLS | =2.6.3 | |
| GnuTLS | =2.6.4 | |
| GnuTLS | =2.6.5 | |
| GnuTLS | =2.6.6 | |
| GnuTLS | =2.7.4 | |
| GnuTLS | =2.8.0 | |
| GnuTLS | =2.8.1 | |
| GnuTLS | =2.8.2 | |
| GnuTLS | =2.8.3 | |
| GnuTLS | =2.8.4 | |
| GnuTLS | =2.8.5 | |
| GnuTLS | =2.8.6 | |
| GnuTLS | =2.10.0 | |
| GnuTLS | =2.10.1 | |
| GnuTLS | =2.10.2 | |
| GnuTLS | =2.10.3 | |
| GnuTLS | =2.10.4 | |
| GnuTLS | =2.10.5 | |
| GnuTLS | =2.12.0 | |
| GnuTLS | =2.12.1 | |
| GnuTLS | =2.12.2 | |
| GnuTLS | =2.12.3 | |
| GnuTLS | =2.12.4 | |
| GnuTLS | =2.12.5 | |
| GnuTLS | =2.12.6 | |
| GnuTLS | =2.12.6.1 | |
| GnuTLS | =2.12.7 | |
| GnuTLS | =2.12.8 | |
| GnuTLS | =2.12.9 | |
| GnuTLS | =2.12.10 | |
| GnuTLS | =2.12.11 | |
| GnuTLS | =2.12.12 | |
| GnuTLS | =2.12.13 | |
| GnuTLS | =2.12.14 | |
| GnuTLS | =3.0 | |
| GnuTLS | =3.0.0 | |
| GnuTLS | =3.0.1 | |
| GnuTLS | =3.0.2 | |
| GnuTLS | =3.0.3 | |
| GnuTLS | =3.0.4 | |
| GnuTLS | =3.0.5 | |
| GnuTLS | =3.0.6 | |
| GnuTLS | =3.0.7 | |
| GnuTLS | =3.0.8 | |
| GnuTLS | =3.0.9 | |
| GnuTLS | =3.0.10 | |
| GnuTLS | =3.0.11 | |
| GnuTLS | =3.0.12 | |
| GnuTLS | =3.0.13 | |
| GnuTLS | =3.0.14 | |
| Libtasn1 | <=2.11 | |
| Libtasn1 | =0.1.0 | |
| Libtasn1 | =0.1.1 | |
| Libtasn1 | =0.1.2 | |
| Libtasn1 | =0.2.0 | |
| Libtasn1 | =0.2.1 | |
| Libtasn1 | =0.2.2 | |
| Libtasn1 | =0.2.3 | |
| Libtasn1 | =0.2.4 | |
| Libtasn1 | =0.2.5 | |
| Libtasn1 | =0.2.6 | |
| Libtasn1 | =0.2.7 | |
| Libtasn1 | =0.2.8 | |
| Libtasn1 | =0.2.9 | |
| Libtasn1 | =0.2.10 | |
| Libtasn1 | =0.2.11 | |
| Libtasn1 | =0.2.12 | |
| Libtasn1 | =0.2.13 | |
| Libtasn1 | =0.2.14 | |
| Libtasn1 | =0.2.15 | |
| Libtasn1 | =0.2.16 | |
| Libtasn1 | =0.2.17 | |
| Libtasn1 | =0.2.18 | |
| Libtasn1 | =0.3.0 | |
| Libtasn1 | =0.3.1 | |
| Libtasn1 | =0.3.2 | |
| Libtasn1 | =0.3.3 | |
| Libtasn1 | =0.3.4 | |
| Libtasn1 | =0.3.5 | |
| Libtasn1 | =0.3.6 | |
| Libtasn1 | =0.3.7 | |
| Libtasn1 | =0.3.8 | |
| Libtasn1 | =0.3.9 | |
| Libtasn1 | =0.3.10 | |
| Libtasn1 | =1.0 | |
| Libtasn1 | =1.1 | |
| Libtasn1 | =1.2 | |
| Libtasn1 | =1.3 | |
| Libtasn1 | =1.4 | |
| Libtasn1 | =1.5 | |
| Libtasn1 | =1.6 | |
| Libtasn1 | =1.7 | |
| Libtasn1 | =1.8 | |
| Libtasn1 | =2.0 | |
| Libtasn1 | =2.1 | |
| Libtasn1 | =2.2 | |
| Libtasn1 | =2.3 | |
| Libtasn1 | =2.4 | |
| Libtasn1 | =2.5 | |
| Libtasn1 | =2.6 | |
| Libtasn1 | =2.7 | |
| Libtasn1 | =2.8 | |
| Libtasn1 | =2.9 | |
| Libtasn1 | =2.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53
- http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54
- http://git.savannah.gnu.org/cgit/libtasn1.git/tree/tests/Test_overflow.c
- http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5957
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=804920#c2
- http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commit;h=88138dc44fc00f2887956d71e0febd2656e1fd9f
- http://www.openwall.com/lists/oss-security/2012/03/20/8
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=805442
- https://rhn.redhat.com/errata/RHSA-2012-0428.html
- https://rhn.redhat.com/errata/RHSA-2012-0427.html
- https://rhn.redhat.com/errata/RHSA-2012-0488.html
- https://rhn.redhat.com/errata/RHSA-2012-0531.html
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=712481
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=712481&action=edit
- https://bugzilla.redhat.com/show_bug.cgi?id=804920
- http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html
- http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932
- http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53
- http://article.gmane.org/gmane.comp.gnu.libtasn1.general/54
- http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/
- http://linux.oracle.com/errata/ELSA-2014-0596.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076856.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076865.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077284.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077339.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078207.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076699.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
- http://rhn.redhat.com/errata/RHSA-2012-0427.html
- http://rhn.redhat.com/errata/RHSA-2012-0488.html
- http://rhn.redhat.com/errata/RHSA-2012-0531.html
- http://secunia.com/advisories/48397
- http://secunia.com/advisories/48488
- http://secunia.com/advisories/48505
- http://secunia.com/advisories/48578
- http://secunia.com/advisories/48596
- http://secunia.com/advisories/49002
- http://secunia.com/advisories/50739
- http://secunia.com/advisories/57260
- http://www.debian.org/security/2012/dsa-2440
- http://www.gnu.org/software/gnutls/security.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:039
- http://www.openwall.com/lists/oss-security/2012/03/20/3
- http://www.openwall.com/lists/oss-security/2012/03/21/5
- http://www.securitytracker.com/id?1026829
- http://www.ubuntu.com/usn/USN-1436-1
Frequently Asked Questions
What is the severity of CVE-2012-1569?
CVE-2012-1569 has been classified as having high severity due to potential remote crashes.
How do I fix CVE-2012-1569?
To fix CVE-2012-1569, you should upgrade the affected GNU GnuTLS and libtasn1 versions to versions 2.12 or higher.
What impacts does CVE-2012-1569 have on system security?
CVE-2012-1569 can lead to denial of service attacks as it may cause crashes during DER decoding.
Which versions of GNU GnuTLS are affected by CVE-2012-1569?
CVE-2012-1569 affects multiple versions of GNU GnuTLS up to 3.0.15.
Is CVE-2012-1569 a local or remote vulnerability?
CVE-2012-1569 is considered a remote vulnerability as it can be exploited from a remote location.
- collector/redhat-bugzilla
- alias/CVE-2012-1569
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/author
- agent/remedy
- agent/references
- agent/weakness
- agent/severity
- agent/event
- agent/description
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/gnutls
- version/gnutls/3.0.15
- version/gnutls/1.0.16
- version/gnutls/1.0.17
- version/gnutls/1.0.18
- version/gnutls/1.0.19
- version/gnutls/1.0.20
- version/gnutls/1.0.21
- version/gnutls/1.0.22
- version/gnutls/1.0.23
- version/gnutls/1.0.24
- version/gnutls/1.0.25
- version/gnutls/1.1.13
- version/gnutls/1.1.14
- version/gnutls/1.1.15
- version/gnutls/1.1.16
- version/gnutls/1.1.17
- version/gnutls/1.1.18
- version/gnutls/1.1.19
- version/gnutls/1.1.20
- version/gnutls/1.1.21
- version/gnutls/1.1.22
- version/gnutls/1.1.23
- version/gnutls/1.2.0
- version/gnutls/1.2.1
- version/gnutls/1.2.2
- version/gnutls/1.2.3
- version/gnutls/1.2.4
- version/gnutls/1.2.5
- version/gnutls/1.2.6
- version/gnutls/1.2.7
- version/gnutls/1.2.8
- version/gnutls/1.2.8.1a1
- version/gnutls/1.2.9
- version/gnutls/1.2.10
- version/gnutls/1.2.11
- version/gnutls/1.3.0
- version/gnutls/1.3.1
- version/gnutls/1.3.2
- version/gnutls/1.3.3
- version/gnutls/1.3.4
- version/gnutls/1.3.5
- version/gnutls/1.4.0
- version/gnutls/1.4.1
- version/gnutls/1.4.2
- version/gnutls/1.4.3
- version/gnutls/1.4.4
- version/gnutls/1.4.5
- version/gnutls/1.5.0
- version/gnutls/1.5.1
- version/gnutls/1.5.2
- version/gnutls/1.5.3
- version/gnutls/1.5.4
- version/gnutls/1.5.5
- version/gnutls/1.6.0
- version/gnutls/1.6.1
- version/gnutls/1.6.2
- version/gnutls/1.6.3
- version/gnutls/1.7.0
- version/gnutls/1.7.1
- version/gnutls/1.7.2
- version/gnutls/1.7.3
- version/gnutls/1.7.4
- version/gnutls/1.7.5
- version/gnutls/1.7.6
- version/gnutls/1.7.7
- version/gnutls/1.7.8
- version/gnutls/1.7.9
- version/gnutls/1.7.10
- version/gnutls/1.7.11
- version/gnutls/1.7.12
- version/gnutls/1.7.13
- version/gnutls/1.7.14
- version/gnutls/1.7.15
- version/gnutls/1.7.16
- version/gnutls/1.7.17
- version/gnutls/1.7.18
- version/gnutls/1.7.19
- version/gnutls/2.0.0
- version/gnutls/2.0.1
- version/gnutls/2.0.2
- version/gnutls/2.0.3
- version/gnutls/2.0.4
- version/gnutls/2.1.0
- version/gnutls/2.1.1
- version/gnutls/2.1.2
- version/gnutls/2.1.3
- version/gnutls/2.1.4
- version/gnutls/2.1.5
- version/gnutls/2.1.6
- version/gnutls/2.1.7
- version/gnutls/2.1.8
- version/gnutls/2.2.0
- version/gnutls/2.2.1
- version/gnutls/2.2.2
- version/gnutls/2.2.3
- version/gnutls/2.2.4
- version/gnutls/2.2.5
- version/gnutls/2.3.0
- version/gnutls/2.3.1
- version/gnutls/2.3.2
- version/gnutls/2.3.3
- version/gnutls/2.3.4
- version/gnutls/2.3.5
- version/gnutls/2.3.6
- version/gnutls/2.3.7
- version/gnutls/2.3.8
- version/gnutls/2.3.9
- version/gnutls/2.3.10
- version/gnutls/2.3.11
- version/gnutls/2.4.0
- version/gnutls/2.4.1
- version/gnutls/2.4.2
- version/gnutls/2.4.3
- version/gnutls/2.5.0
- version/gnutls/2.6.0
- version/gnutls/2.6.1
- version/gnutls/2.6.2
- version/gnutls/2.6.3
- version/gnutls/2.6.4
- version/gnutls/2.6.5
- version/gnutls/2.6.6
- version/gnutls/2.7.4
- version/gnutls/2.8.0
- version/gnutls/2.8.1
- version/gnutls/2.8.2
- version/gnutls/2.8.3
- version/gnutls/2.8.4
- version/gnutls/2.8.5
- version/gnutls/2.8.6
- version/gnutls/2.10.0
- version/gnutls/2.10.1
- version/gnutls/2.10.2
- version/gnutls/2.10.3
- version/gnutls/2.10.4
- version/gnutls/2.10.5
- version/gnutls/2.12.0
- version/gnutls/2.12.1
- version/gnutls/2.12.2
- version/gnutls/2.12.3
- version/gnutls/2.12.4
- version/gnutls/2.12.5
- version/gnutls/2.12.6
- version/gnutls/2.12.6.1
- version/gnutls/2.12.7
- version/gnutls/2.12.8
- version/gnutls/2.12.9
- version/gnutls/2.12.10
- version/gnutls/2.12.11
- version/gnutls/2.12.12
- version/gnutls/2.12.13
- version/gnutls/2.12.14
- version/gnutls/3.0
- version/gnutls/3.0.0
- version/gnutls/3.0.1
- version/gnutls/3.0.2
- version/gnutls/3.0.3
- version/gnutls/3.0.4
- version/gnutls/3.0.5
- version/gnutls/3.0.6
- version/gnutls/3.0.7
- version/gnutls/3.0.8
- version/gnutls/3.0.9
- version/gnutls/3.0.10
- version/gnutls/3.0.11
- version/gnutls/3.0.12
- version/gnutls/3.0.13
- version/gnutls/3.0.14
- canonical/libtasn1
- version/libtasn1/2.11
- version/libtasn1/0.1.0
- version/libtasn1/0.1.1
- version/libtasn1/0.1.2
- version/libtasn1/0.2.0
- version/libtasn1/0.2.1
- version/libtasn1/0.2.2
- version/libtasn1/0.2.3
- version/libtasn1/0.2.4
- version/libtasn1/0.2.5
- version/libtasn1/0.2.6
- version/libtasn1/0.2.7
- version/libtasn1/0.2.8
- version/libtasn1/0.2.9
- version/libtasn1/0.2.10
- version/libtasn1/0.2.11
- version/libtasn1/0.2.12
- version/libtasn1/0.2.13
- version/libtasn1/0.2.14
- version/libtasn1/0.2.15
- version/libtasn1/0.2.16
- version/libtasn1/0.2.17
- version/libtasn1/0.2.18
- version/libtasn1/0.3.0
- version/libtasn1/0.3.1
- version/libtasn1/0.3.2
- version/libtasn1/0.3.3
- version/libtasn1/0.3.4
- version/libtasn1/0.3.5
- version/libtasn1/0.3.6
- version/libtasn1/0.3.7
- version/libtasn1/0.3.8
- version/libtasn1/0.3.9
- version/libtasn1/0.3.10
- version/libtasn1/1.0
- version/libtasn1/1.1
- version/libtasn1/1.2
- version/libtasn1/1.3
- version/libtasn1/1.4
- version/libtasn1/1.5
- version/libtasn1/1.6
- version/libtasn1/1.7
- version/libtasn1/1.8
- version/libtasn1/2.0
- version/libtasn1/2.1
- version/libtasn1/2.2
- version/libtasn1/2.3
- version/libtasn1/2.4
- version/libtasn1/2.5
- version/libtasn1/2.6
- version/libtasn1/2.7
- version/libtasn1/2.8
- version/libtasn1/2.9
- version/libtasn1/2.10