libtasn1 version 2.12 was released fixing the following issue:
- Corrected DER decoding issue (reported by Matthew Hall). Added self check to detect the problem, see tests/Testoverflow.c. This problem can lead to at least remotely triggered crashes, see further analysis on the libtasn1 mailing list.
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/53
Upstream and few limited details are available at:
http://thread.gmane.org/gmane.comp.gnu.libtasn1.general/54
The behavior of asn1getlengthder was changed to protect against accidental incorrect use, if though it was previously "working properly and as documented".
GnuTLS 3.0.15 was released fixing the following issue:
libgnutls: Corrections in record packet parsing. Reported by Matthew Hall. http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912
Patch for 2.x: http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=422214868061370aeeb0ac9cd0f021a5c350a57d
Patch for 3.x: http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=b495740f2ff66550ca9395b3fda3ea32c3acb185
A flaw in how TLS/DTLS, when CBC-mode encryption is used, communicates was reported. This vulnerability can allow for a Man-in-the-Middle attacker to recover plaintext from a TLS/DTLS connection, when CBC-mode encryption is used.
This flaw is in the TLS specification, and not a bug in a specific implementation (as such, it affects nearly all implementations). As such, it affects all TLS and DTLS implementations that are compliant with TLS 1.1 or 1.2, or with DTLS 1.0 or 1.2. It also applies to implementations of SSL 3.0 and TLS 1.0 that incorporate countermeasures to deal with previous padding oracle attacks. All TLS/DTLS ciphersuites that include CBC-mode encryption are potentially vulnerable.
The paper indicates that with OpenSSL, a full plaintext recovery attack is possible, and with GnuTLS, a partial plaintext recovery is possible (recovering up to 4 bits of the last byte in any block of plaintext).
To perform a successful attack, when TLS is used, a large number of TLS sessions are required (target plaintext must be sent repeatedly in the same position in the plaintext stream across the sessions). For DTLS, a successful attack can be carried out in a single session. The attacker must also be located close to the machine being attacked.
Further details are noted in the paper:
http://www.isg.rhul.ac.uk/tls/TLStiming.pdf
External References:
http://www.isg.rhul.ac.uk/tls/ http://www.gnutls.org/security.html#GNUTLS-SA-2013-1
Patches:
2.12.x: https://gitorious.org/gnutls/gnutls/commit/458c67cf98740e7b12404f6c30e0d5317d56fd30 https://gitorious.org/gnutls/gnutls/commit/93b7fcfa3297a9123630704668b2946f602b910e
3.0.x: https://gitorious.org/gnutls/gnutls/commit/8dc2822966f64dd9cf7dde9c7aacd80d49d3ffe5
3.2.x / master: https://gitorious.org/gnutls/gnutls/commit/328ee22c1b3951e060c7124c7cb1cee592c59bc0
GnuTLS incorrectly validates the first byte of padding in CBC modes