Published: 05/05/2016 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 prior to 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote malicious users to cause a denial of service (infinite recursion) via a crafted certificate.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 12.04
canonical ubuntu linux 16.04
canonical ubuntu linux 15.10
canonical ubuntu linux 14.04
opensuse opensuse 13.2
gnu libtasn1
fedoraproject fedora 22
fedoraproject fedora 24
fedoraproject fedora 23

Libtasn1 could be made to hang if it processed specially crafted data ...

Pascal Cuoq and Miod Vallat discovered that Libtasn1, a library to manage ASN1 structures, does not correctly handle certain malformed DER certificates A remote attacker can take advantage of this flaw to cause an application using the Libtasn1 library to hang, resulting in a denial of service For the stable distribution (jessie), this problem h ...

The _asn1_extract_der_octet function in lib/decodingc in GNU Libtasn1 before 48, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate ...

CWE-399 http://www.ubuntu.com/usn/USN-2957-1 http://www.openwall.com/lists/oss-security/2016/04/11/3 https://lists.gnu.org/archive/html/help-libtasn1/2016-04/msg00009.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182299.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182907.html http://www.ubuntu.com/usn/USN-2957-2 http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183221.html http://lists.opensuse.org/opensuse-updates/2016-06/msg00047.html http://www.debian.org/security/2016/dsa-3568 https://security.gentoo.org/glsa/201703-05 http://lists.opensuse.org/opensuse-updates/2016-06/msg00097.html http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=a6e0a0b58f5cdaf4e9beca5bce69c09808cbb625 http://git.savannah.gnu.org/gitweb/?p=libtasn1.git%3Ba=commit%3Bh=f435825c0f527a8e52e6ffbc3ad0bc60531d537e https://usn.ubuntu.com/2957-1/https://nvd.nist.gov

CVE-2016-4008

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect