Published: 26/03/2012 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

gnutls_cipher.c in libgnutls in GnuTLS prior to 2.12.17 and 3.x prior to 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote malicious users to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu gnutls 2.12.15
gnu gnutls 2.3.5
gnu gnutls 2.10.2
gnu gnutls 2.0.0
gnu gnutls 2.8.3
gnu gnutls 2.3.4
gnu gnutls 2.12.2
gnu gnutls 2.7.4
gnu gnutls 2.6.1
gnu gnutls 2.2.4
gnu gnutls 2.1.0
gnu gnutls 2.3.1
gnu gnutls 2.12.7
gnu gnutls 2.12.5
gnu gnutls 2.2.5
gnu gnutls 2.1.1
gnu gnutls 2.3.8
gnu gnutls 2.8.5
gnu gnutls 2.1.7
gnu gnutls 2.10.4
gnu gnutls 2.1.4
gnu gnutls 2.6.0
gnu gnutls 2.1.6
gnu gnutls 2.8.0
gnu gnutls 2.12.14
gnu gnutls 2.12.8
gnu gnutls 2.4.3
gnu gnutls 2.3.2
gnu gnutls 2.3.9
gnu gnutls 2.2.2
gnu gnutls 2.2.0
gnu gnutls 2.3.11
gnu gnutls 2.5.0
gnu gnutls 2.6.2
gnu gnutls 2.10.1
gnu gnutls 2.12.6.1
gnu gnutls 2.12.0
gnu gnutls 2.12.10
gnu gnutls 2.0.4
gnu gnutls 2.6.3
gnu gnutls 2.6.6
gnu gnutls 2.12.6
gnu gnutls 2.10.3
gnu gnutls 2.4.0
gnu gnutls 2.1.3
gnu gnutls 2.8.6
gnu gnutls 2.4.1
gnu gnutls 2.12.9
gnu gnutls 2.3.7
gnu gnutls 2.0.3
gnu gnutls 2.10.5
gnu gnutls 2.6.5
gnu gnutls 2.8.2
gnu gnutls 2.12.13
gnu gnutls 2.1.2
gnu gnutls 2.4.2
gnu gnutls 2.6.4
gnu gnutls 2.3.6
gnu gnutls 2.3.3
gnu gnutls 2.1.8
gnu gnutls 2.0.1
gnu gnutls 2.12.12
gnu gnutls 2.12.3
gnu gnutls 2.12.4
gnu gnutls
gnu gnutls 2.2.1
gnu gnutls 2.1.5
gnu gnutls 2.8.1
gnu gnutls 2.12.11
gnu gnutls 2.12.1
gnu gnutls 2.10.0
gnu gnutls 2.3.10
gnu gnutls 2.0.2
gnu gnutls 2.3.0
gnu gnutls 2.2.3
gnu gnutls 2.8.4
gnu gnutls 3.0.12
gnu gnutls 3.0.3
gnu gnutls 3.0.9
gnu gnutls 3.0.6
gnu gnutls 3.0.8
gnu gnutls 3.0
gnu gnutls 3.0.0
gnu gnutls 3.0.11
gnu gnutls 3.0.7
gnu gnutls 3.0.2
gnu gnutls 3.0.13
gnu gnutls 3.0.5
gnu gnutls 3.0.14
gnu gnutls 3.0.10
gnu gnutls 3.0.1
gnu gnutls 3.0.4

The GnuTLS library could be made to crash under certain conditions ...

Matthew Hall discovered that GNUTLS does not properly handle truncated GenericBlockCipher structures nested inside TLS records, leading to crashes in applications using the GNUTLS library For the stable distribution (squeeze), this problem has been fixed in version 286-1+squeeze2 For the unstable distribution (sid), this problem has been fixed ...

Synopsis Important: gnutls security update Type/Severity Security Advisory: Important Topic Updated gnutls packages that fix two security issues are now available forRed Hat Enterprise Linux 6The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability S ...

Synopsis Important: gnutls security update Type/Severity Security Advisory: Important Topic Updated gnutls packages that fix three security issues are now availablefor Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability ...

Synopsis Important: rhev-hypervisor6 security and bug fix update Type/Severity Security Advisory: Important Topic An updated rhev-hypervisor6 package that fixes three security issues andone bug is now availableThe Red Hat Security Response Team has rated this update as havingimportant security impact Comm ...

A flaw was found in the way GnuTLS decrypted malformed TLS records This could cause a TLS/SSL client or server to crash when processing a specially-crafted TLS record from a remote TLS/SSL connection peer (CVE-2012-1573) A boundary error was found in the gnutls_session_get_data() function A malicious TLS/SSL server could use this flaw to crash a ...

CWE-310 http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910 http://www.gnu.org/software/gnutls/security.html http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912 http://www.openwall.com/lists/oss-security/2012/03/21/5 http://www.openwall.com/lists/oss-security/2012/03/21/4 http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/https://bugzilla.redhat.com/show_bug.cgi?id=805432 http://osvdb.org/80259 http://secunia.com/advisories/48596 http://rhn.redhat.com/errata/RHSA-2012-0429.html http://www.ubuntu.com/usn/USN-1418-1 http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html http://www.securitytracker.com/id?1026828 http://secunia.com/advisories/48488 http://secunia.com/advisories/48712 http://rhn.redhat.com/errata/RHSA-2012-0531.html http://rhn.redhat.com/errata/RHSA-2012-0488.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html http://secunia.com/advisories/57260 http://secunia.com/advisories/48511 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html http://www.securityfocus.com/bid/52667 http://www.debian.org/security/2012/dsa-2441 http://www.mandriva.com/security/advisories?name=MDVSA-2012:040 http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185 http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=422214868061370aeeb0ac9cd0f021a5c350a57d https://usn.ubuntu.com/1418-1/https://nvd.nist.gov

Get Started

CVE-2012-1573

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect