Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.

Evgeny Legerov discovered several out-of-bounds memory accesses in the DER decoding component of the Tiny ASN.1 Library, which is also present and used in GnuTLS, the GNU implementation for Transport Layer Security (TLS) 1.0 and Secure Sockets Layer (SSL) 3.0 protocols and which allows attackers to crash the DER decoder and possibly execute arbitrary code.

Evgeny Legerov discovered several out-of-bounds memory accesses in the DER decoding component of the Tiny ASN.1 Library that allows attackers to crash the DER decoder and possibly execute arbitrary code.

Updated gnutls packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The GNU TLS Library provides support for cryptographic algorithms and protocols such as TLS. GNU TLS includes Libtasn1, a library developed for ASN.1 structures management that includes DER encoding and decoding.

Several flaws were found in the way libtasn1 decodes DER. An attacker could create a carefully crafted invalid X.509 certificate in such a way that could trigger this flaw if parsed by an application that uses GNU TLS. This could lead to a denial of service (application crash).
It is not certain if this issue could be escalated to allow arbitrary code execution. The Common Vulnerabilities and Exposures project assigned the name CVE-2006-0645 to this issue.

In Red Hat Enterprise Linux 4, the GNU TLS library is only used by the Evolution client when connecting to an Exchange server or when publishing calendar information to a WebDAV server.

Users are advised to upgrade to these updated packages, which contain a backported patch from the GNU TLS maintainers to correct this issue.

Evgeny Legerov discovered a buffer overflow in the DER format decoding function of the libtasn library. This library is mainly used by the GNU TLS library; by sending a specially crafted X.509 certificate to a server which uses TLS encryption/authentication, a remote attacker could exploit this to crash that server process and possibly even execute arbitrary code with the privileges of that server.

In order to fix the vulnerability in libtasn, several internal function signatures had to be changed; some of these functions are used by the GNU TLS library, so that library needs to be updated as well.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200602-08 (libtasn1, GNU TLS: Security flaw in DER decoding)

    Evgeny Legerov has reported a flaw in the DER decoding routines     provided by libtasn1, which could cause an out of bounds access to     occur.
  Impact :

    A remote attacker could cause an application using libtasn1 to     crash and potentially execute arbitrary code by sending specially     crafted input.
  Workaround :

    There is no known workaround at this time.

Evgeny Legerov discovered cases of possible out-of-bounds access in the DER decoding schemes of libtasn1, when provided with invalid input. This library is bundled with gnutls.

The provided packages have been patched to correct these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2006:0207 advisory.

  - - libtasn1 buffer overflow (CVE-2006-0645)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- Fri Feb 10 2006 Martin Stransky <stransky at redhat.com>     1.0.25-2.FC4

    - fix for CVE-2006-0645

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
22852	Debian DSA-986-1 : gnutls11 - buffer overflows	Nessus	Debian Local Security Checks	high
22851	Debian DSA-985-1 : libtasn1-2 - buffer overflows	Nessus	Debian Local Security Checks	high
21987	CentOS 4 : gnutls (CESA-2006:0207)	Nessus	CentOS Local Security Checks	high
21060	Ubuntu 4.10 / 5.04 / 5.10 : libtasn1-2 vulnerability (USN-251-1)	Nessus	Ubuntu Local Security Checks	high
20934	GLSA-200602-08 : libtasn1, GNU TLS: Security flaw in DER decoding	Nessus	Gentoo Local Security Checks	high
20897	Mandrake Linux Security Advisory : gnutls (MDKSA-2006:039)	Nessus	Mandriva Local Security Checks	high
20886	RHEL 4 : gnutls (RHSA-2006:0207)	Nessus	Red Hat Local Security Checks	critical
20884	Fedora Core 4 : gnutls-1.0.25-2.FC4 (2006-107)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2006-0645

critical

Tenable Plugins

high

high

high

high

high

high

critical

high