Published: 10/02/2006 Updated: 19/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Tiny ASN.1 Library (libtasn1) prior to 0.2.18, as used by (1) GnuTLS 1.2.x prior to 1.2.10 and 1.3.x prior to 1.3.4, and (2) GNU Shishi, allows malicious users to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.

Vulnerable Product	Search on Vulmon	Subscribe to Product
free software foundation inc. libtasn1 0.2.0
free software foundation inc. libtasn1 0.2.1
free software foundation inc. libtasn1 0.2.17
free software foundation inc. libtasn1 0.2.2
free software foundation inc. libtasn1 0.2.9
free software foundation inc. libtasn1 0.1.1
free software foundation inc. libtasn1 0.1.2
free software foundation inc. libtasn1 0.2.14
free software foundation inc. libtasn1 0.2.15
free software foundation inc. libtasn1 0.2.16
free software foundation inc. libtasn1 0.2.7
free software foundation inc. libtasn1 0.2.8
free software foundation inc. libtasn1 0.2.10
free software foundation inc. libtasn1 0.2.11
free software foundation inc. libtasn1 0.2.3
free software foundation inc. libtasn1 0.2.4
free software foundation inc. libtasn1 0.1.0
free software foundation inc. libtasn1 0.2.12
free software foundation inc. libtasn1 0.2.13
free software foundation inc. libtasn1 0.2.5
free software foundation inc. libtasn1 0.2.6

Evgeny Legerov discovered a buffer overflow in the DER format decoding function of the libtasn library This library is mainly used by the GNU TLS library; by sending a specially crafted X509 certificate to a server which uses TLS encryption/authentication, a remote attacker could exploit this to crash that server process and possibly even execute ...

Evgeny Legerov discovered several out-of-bounds memory accesses in the DER decoding component of the Tiny ASN1 Library, which is also present and used in GnuTLS, the GNU implementation for Transport Layer Security (TLS) 10 and Secure Sockets Layer (SSL) 30 protocols and which allows attackers to crash the DER decoder and possibly execute arbitra ...

Evgeny Legerov discovered several out-of-bounds memory accesses in the DER decoding component of the Tiny ASN1 Library that allows attackers to crash the DER decoder and possibly execute arbitrary code The old stable distribution (woody) is not affected by these problems For the stable distribution (sarge) these problems have been fixed in versi ...

NVD-CWE-Other http://www.gleg.net/protover_ssl.shtml http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html http://rhn.redhat.com/errata/RHSA-2006-0207.html http://www.osvdb.org/23054 http://securitytracker.com/id?1015612 http://secunia.com/advisories/18794 http://secunia.com/advisories/18815 http://secunia.com/advisories/18830 http://secunia.com/advisories/18832 http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml http://www.securityfocus.com/bid/16568 http://secunia.com/advisories/18918 http://secunia.com/advisories/18898 http://www.trustix.org/errata/2006/0008 http://www.debian.org/security/2006/dsa-986 http://www.debian.org/security/2006/dsa-985 http://secunia.com/advisories/19080 http://secunia.com/advisories/19092 http://www.mandriva.com/security/advisories?name=MDKSA-2006:039 http://securityreason.com/securityalert/446 http://www.vupen.com/english/advisories/2006/0496 https://exchange.xforce.ibmcloud.com/vulnerabilities/24606 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540 https://usn.ubuntu.com/251-1/http://www.securityfocus.com/archive/1/424538/100/0/threaded https://usn.ubuntu.com/251-1/https://nvd.nist.gov

CVE-2006-0645

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect