CVE-2014-3466: Buffer Overflow
A flaw was found in the way GnuTLS parsed session ids from Server Hello packets of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session id value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code.
The flaw is in readserverhello() / gnutlsreadserverhello(), where sessionidlen is checked to not exceed incoming packet size, but not checked to ensure it does not exceed maximum session id length: https://www.gitorious.org/gnutls/gnutls/source/8d7d6c6:lib/gnutlshandshake.c#L1747
Other sources
Buffer overflow in the readserverhello function in lib/gnutlshandshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3466?
The severity of CVE-2014-3466 is considered high due to the potential for a buffer overflow that could lead to a crash.
How do I fix CVE-2014-3466?
To fix CVE-2014-3466, upgrade GnuTLS to version 3.1.25 or later, 3.2.15 or later, or 3.3.3 or later.
Which versions of GnuTLS are affected by CVE-2014-3466?
CVE-2014-3466 affects GnuTLS versions prior to 3.1.25, 3.2.15, and 3.3.3.
What types of applications are impacted by CVE-2014-3466?
Applications using vulnerable versions of GnuTLS may be impacted by this vulnerability, especially those utilizing TLS/SSL connections.
Is CVE-2014-3466 a remote exploit?
Yes, CVE-2014-3466 can be exploited remotely by a malicious server during a TLS/SSL handshake.