Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially crafted assignments file via the e.g. asn1Coding utility.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtasn1: stack overflow in asn1_der_decoding (CVE-2015-2806)

  - libtasn1: Stack-based buffer overflow in asn1_find_node() (CVE-2017-6891)

  - libtasn1: Infinite loop in _asn1_expand_object_id(ptree) leads to memory exhaustion (CVE-2018-1000654)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libtasn1: Stack-based buffer overflow in asn1_find_node() (CVE-2017-6891)

  - libtasn1: Infinite loop in _asn1_expand_object_id(ptree) leads to memory exhaustion (CVE-2018-1000654)

  - The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and     crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure.
    It may lead to a remote denial of service attack. (CVE-2017-10790)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3797-1 advisory.

  - Two errors in the asn1_find_node() function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can     be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially     crafted assignments file via the e.g. asn1Coding utility. (CVE-2017-6891)

  - GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU     usage will reach 100% when running asn1Paser against the POC due to an issue in
    _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be     exploitable via parsing a crafted file. (CVE-2018-1000654)

  - GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects     asn1_encode_simple_der. (CVE-2021-46848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libtasn1 fixes the following issues :

Security issues fixed :

  - CVE-2018-1000654: Fixed a denial of service in the asn1     parser (bsc#1105435).

  - CVE-2017-6891: Fixed a stack overflow in     asn1_find_node() (bsc#1040621).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libtasn1 fixes the following issues :

Security issues fixed :

CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).

CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtasn1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Two errors in the 'asn1_find_node()' function     (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10     can be exploited to cause a stacked-based buffer     overflow by tricking a user into processing a specially     crafted assignments file via the e.g. asn1Coding     utility.(CVE-2017-6891)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtasn1 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Two errors in the 'asn1_find_node()' function     (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10     can be exploited to cause a stacked-based buffer     overflow by tricking a user into processing a specially     crafted assignments file via the e.g. asn1Coding     utility.i1/4^CVE-2017-6891i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libtasn1 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Two errors in the 'asn1_find_node()' function     (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10     can be exploited to cause a stacked-based buffer     overflow by tricking a user into processing a specially     crafted assignments file via the e.g. asn1Coding     utility.(CVE-2017-6891)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-11 (GNU Libtasn1: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU Libtasn1. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or have       other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

This update for gnutls fixes the following issues :

  - GNUTLS-SA-2017-3 / CVE-2017-7869: An out-of-bounds write     in OpenPGP certificate decoding was fixed (bsc#1034173)

  - CVE-2017-6891: A potential stack-based buffer overflow     in the bundled libtasn1 was fixed (bsc#1040621)

  - An address read of 4 bytes past the end of buffer in     OpenPGP certificate parsing was fixed (bsc#1038337)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Noteworthy changes in release 4.11 (released 2017-05-27) [stable]

  - Introduced the ASN1_TIME_ENCODING_ERROR error code to     indicate an invalid encoding in the DER time fields.

  - Introduced flag ASN1_DECODE_FLAG_ALLOW_INCORRECT_TIME.
    This flag allows decoding errors in time fields even     when in strict DER mode. That is introduced in order to     allow toleration of invalid times in X.509 certificates     (which are common) even though strict DER adherence is     enforced in other fields.

  - Added safety check in asn1_find_node(). That prevents a     crash when a very long variable name is provided by the     developer. Note that this to be exploited requires     controlling the ASN.1 definitions used by the developer,     i.e., the 'name' parameter of asn1_write_value() or     asn1_read_value(). The library is not designed to     protect against malicious manipulation of the developer     assigned variable names. Reported by Jakub Jirasek.

Noteworthy changes in release 4.10 (released 2017-01-16) [stable]

  - Updated gnulib

  - Removed -Werror from default compiler flags

  - Fixed undefined behavior when negating integers in
    _asn1_ltostr(). Issue found by oss-fuzz project (via     gnutls):
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38     8

  - Pass the correct length to
    _asn1_get_indefinite_length_string in     asn1_get_length_ber. This addresses reading 1-byte past     the end of data. Issue found by oss-fuzz project (via     gnutls):
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33     0     https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33     1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 4.12 (#1456190)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3309-1 advisory.

    Jakub Jirasek discovered that GnuTLS incorrectly handled certain assignments files. If a user were tricked     into processing a specially crafted assignments file, a remote attacker could possibly execute arbirary     code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Jakub Jirasek of Secunia Research discovered that libtasn1, a library used to handle Abstract Syntax Notation One structures, did not properly validate its input. This would allow an attacker to cause a crash by denial-of-service, or potentially execute arbitrary code, by tricking a user into processing a maliciously crafted assignments file.

Secunia Research has discovered multiple vulnerabilities in GnuTLS libtasn1, which can be exploited by malicious people to compromise a vulnerable system.

Two errors in the 'asn1_find_node()' function (lib/parser_aux.c) can be exploited to cause a stacked-based buffer overflow.

Successful exploitation of the vulnerabilities allows execution of arbitrary code but requires tricking a user into processing a specially crafted assignments file by e.g. asn1Coding utility.

For Debian 7 'Wheezy', this problem has been fixed in version 2.13-2+deb7u4.

We recommend that you upgrade your libtasn1-3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198810	RHEL 6 : libtasn1 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198787	RHEL 7 : libtasn1 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
166694	SUSE SLES12 Security Update : libtasn1 (SUSE-SU-2022:3797-1)	Nessus	SuSE Local Security Checks	critical
125757	openSUSE Security Update : libtasn1 (openSUSE-2019-1510)	Nessus	SuSE Local Security Checks	high
125592	SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2019:1379-1)	Nessus	SuSE Local Security Checks	high
124439	EulerOS 2.0 SP3 : libtasn1 (EulerOS-SA-2019-1312)	Nessus	Huawei Local Security Checks	high
124438	EulerOS 2.0 SP2 : libtasn1 (EulerOS-SA-2019-1311)	Nessus	Huawei Local Security Checks	high
123848	EulerOS Virtualization 2.5.3 : libtasn1 (EulerOS-SA-2019-1162)	Nessus	Huawei Local Security Checks	high
122704	EulerOS Virtualization 2.5.2 : libtasn1 (EulerOS-SA-2019-1082)	Nessus	Huawei Local Security Checks	high
118423	EulerOS Virtualization 2.5.1 : libtasn1 (EulerOS-SA-2018-1335)	Nessus	Huawei Local Security Checks	high
118422	EulerOS Virtualization 2.5.0 : libtasn1 (EulerOS-SA-2018-1334)	Nessus	Huawei Local Security Checks	high
103846	GLSA-201710-11 : GNU Libtasn1: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
101768	SUSE SLES11 Security Update : gnutls (SUSE-SU-2017:1886-1)	Nessus	SuSE Local Security Checks	high
101725	Fedora 26 : mingw-libtasn1 (2017-d5cf1a55ce)	Nessus	Fedora Local Security Checks	high
101634	Fedora 26 : libtasn1 (2017-5115baf0e6)	Nessus	Fedora Local Security Checks	high
100633	Ubuntu 14.04 LTS / 16.04 LTS : Libtasn1 vulnerability (USN-3309-1)	Nessus	Ubuntu Local Security Checks	high
100627	Fedora 25 : libtasn1 (2017-c7c3f7ed26)	Nessus	Fedora Local Security Checks	high
100392	Debian DSA-3861-1 : libtasn1-6 - security update	Nessus	Debian Local Security Checks	high
100360	Debian DLA-950-1 : libtasn1-3 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-6891

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high