The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attackers to cause a denial of service (infinite recursion) via a crafted certificate.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gnutls: Heap read overflow in read-packet.c (CVE-2017-5337)

  - The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can     encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-     in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series     of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header,     aka a CRIME attack. (CVE-2012-4929)

  - GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows     man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not     yet valid or (2) no longer valid. (CVE-2014-8155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtasn1: asn1_get_bit_der() can return negative bit length (CVE-2014-3468)

  - gnutls: HMAC-SHA-384 vulnerable to Lucky thirteen attack due to use of wrong constant (CVE-2018-10845)

  - The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before     3.0.16 and other products, does not properly handle certain large length values, which allows remote     attackers to cause a denial of service (heap memory corruption and application crash) or possibly have     unspecified other impact via a crafted ASN.1 structure. (CVE-2012-1569)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - gnutls: certificate algorithm consistency checking issue (CVE-2015-0294)

  - gnutls: use-after-free flaw in CRL distribution points parsing (CVE-2015-3308)

  - Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause     a denial of service via a long DistinguishedName (DN) entry in a certificate. (CVE-2015-6251)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

An update of the libtasn1 package has been released.

The remote host is affected by the vulnerability described in GLSA-201703-05 (GNU Libtasn1: Denial of Service)

    Libtasn1 does not correctly handle certain malformed DER certificates.
  Impact :

    A remote attacker could entice a user or automated system to process a       specially crafted certificate using Libtasn1, resulting in a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

- CVE-2016-4008: infinite loop while parsing DER     certificates The _asn1_extract_der_octet function in     lib/decoding.c in GNU Libtasn1 before 4.8, when used     without the ASN1_DECODE_FLAG_STRICT_DER flag, allows     remote attackers to cause a denial of service (infinite     recursion) via a crafted certificate.

For Debian 7 'Wheezy', these problems have been fixed in version 2.13-2+deb7u3.

We recommend that you upgrade your libtasn1-3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pascal Cuoq and Miod Vallat discovered that Libtasn1, a library to manage ASN.1 structures, does not correctly handle certain malformed DER certificates. A remote attacker can take advantage of this flaw to cause an application using the Libtasn1 library to hang, resulting in a denial of service.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2957-2 advisory.

    USN-2957-1 fixed a vulnerability in Libtasn1. This update provides the corresponding update for Ubuntu     16.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2957-1 advisory.

    Pascal Cuoq and Miod Vallat discovered that Libtasn1 incorrectly handled certain malformed DER     certificates. A remote attacker could possibly use this issue to cause applications using Libtasn1 to     hang, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to 4.8

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

GNU Libtasn1 NEWS reports :

Fixes to avoid an infinite recursion when decoding without the ASN1_DECODE_FLAG_STRICT_DER flag. Reported by Pascal Cuoq.

ID	Name	Product	Family	Severity
198427	RHEL 5 : gnutls (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
198376	RHEL 6 : gnutls (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
198359	RHEL 7 : gnutls (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196238	RHEL 7 : libtasn1 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196237	RHEL 5 : libtasn1 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	medium
196236	RHEL 6 : libtasn1 (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
121655	Photon OS 1.0: Libtasn1 PHSA-2016-0013	Nessus	PhotonOS Local Security Checks	medium
99012	GLSA-201703-05 : GNU Libtasn1: Denial of Service	Nessus	Gentoo Local Security Checks	medium
93152	SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2016:1601-1)	Nessus	SuSE Local Security Checks	medium
93151	SUSE SLES11 Security Update : libtasn1 (SUSE-SU-2016:1600-1)	Nessus	SuSE Local Security Checks	medium
91868	openSUSE Security Update : libtasn1 (openSUSE-2016-773)	Nessus	SuSE Local Security Checks	medium
91619	openSUSE Security Update : libtasn1 (openSUSE-2016-716)	Nessus	SuSE Local Security Checks	medium
91362	Debian DLA-495-1 : libtasn1-3 security update	Nessus	Debian Local Security Checks	medium
90927	Debian DSA-3568-1 : libtasn1-6 - security update	Nessus	Debian Local Security Checks	medium
90857	Ubuntu 16.04 LTS : Libtasn1 vulnerability (USN-2957-2)	Nessus	Ubuntu Local Security Checks	medium
90856	Ubuntu 14.04 LTS : Libtasn1 vulnerability (USN-2957-1)	Nessus	Ubuntu Local Security Checks	medium
90770	Fedora 22 : libtasn1-4.8-1.fc22 (2016-96bfd9e873)	Nessus	Fedora Local Security Checks	medium
90645	Fedora 23 : libtasn1-4.8-1.fc23 (2016-383b8250e6)	Nessus	Fedora Local Security Checks	medium
90640	Fedora 24 : libtasn1-4.8-1.fc24 (2016-048ffb6235)	Nessus	Fedora Local Security Checks	medium
90605	FreeBSD : libtasn1 -- denial of service parsing malicious DER certificates (1b0d2938-0766-11e6-94fa-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-4008

medium

Tenable Plugins

critical

medium

high

critical

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium