CVE-2012-1569

Published: Mar 26, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.

Affected (221)

Products: Gnu: Gnutls, Libtasn1

Gnu

2 products

Gnutls

Libtasn1

Configuration A

221 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Up to 3.0.15
Gnu Gnutls	Version 1.0.16
Gnu Gnutls	Version 1.0.17
Gnu Gnutls	Version 1.0.18
Gnu Gnutls	Version 1.0.19
Gnu Gnutls	Version 1.0.20
Gnu Gnutls	Version 1.0.21
Gnu Gnutls	Version 1.0.22
Gnu Gnutls	Version 1.0.23
Gnu Gnutls	Version 1.0.24
Gnu Gnutls	Version 1.0.25
Gnu Gnutls	Version 1.1.13
Gnu Gnutls	Version 1.1.14
Gnu Gnutls	Version 1.1.15
Gnu Gnutls	Version 1.1.16
Gnu Gnutls	Version 1.1.17
Gnu Gnutls	Version 1.1.18
Gnu Gnutls	Version 1.1.19
Gnu Gnutls	Version 1.1.20
Gnu Gnutls	Version 1.1.21
Gnu Gnutls	Version 1.1.22
Gnu Gnutls	Version 1.1.23
Gnu Gnutls	Version 1.2.0
Gnu Gnutls	Version 1.2.10
Gnu Gnutls	Version 1.2.11
Gnu Gnutls	Version 1.2.1
Gnu Gnutls	Version 1.2.2
Gnu Gnutls	Version 1.2.3
Gnu Gnutls	Version 1.2.4
Gnu Gnutls	Version 1.2.5
Gnu Gnutls	Version 1.2.6
Gnu Gnutls	Version 1.2.7
Gnu Gnutls	Version 1.2.8.1a1
Gnu Gnutls	Version 1.2.8
Gnu Gnutls	Version 1.2.9
Gnu Gnutls	Version 1.3.0
Gnu Gnutls	Version 1.3.1
Gnu Gnutls	Version 1.3.2
Gnu Gnutls	Version 1.3.3
Gnu Gnutls	Version 1.3.4
Gnu Gnutls	Version 1.3.5
Gnu Gnutls	Version 1.4.0
Gnu Gnutls	Version 1.4.1
Gnu Gnutls	Version 1.4.2
Gnu Gnutls	Version 1.4.3
Gnu Gnutls	Version 1.4.4
Gnu Gnutls	Version 1.4.5
Gnu Gnutls	Version 1.5.0
Gnu Gnutls	Version 1.5.1
Gnu Gnutls	Version 1.5.2
Gnu Gnutls	Version 1.5.3
Gnu Gnutls	Version 1.5.4
Gnu Gnutls	Version 1.5.5
Gnu Gnutls	Version 1.6.0
Gnu Gnutls	Version 1.6.1
Gnu Gnutls	Version 1.6.2
Gnu Gnutls	Version 1.6.3
Gnu Gnutls	Version 1.7.0
Gnu Gnutls	Version 1.7.10
Gnu Gnutls	Version 1.7.11
Gnu Gnutls	Version 1.7.12
Gnu Gnutls	Version 1.7.13
Gnu Gnutls	Version 1.7.14
Gnu Gnutls	Version 1.7.15
Gnu Gnutls	Version 1.7.16
Gnu Gnutls	Version 1.7.17
Gnu Gnutls	Version 1.7.18
Gnu Gnutls	Version 1.7.19
Gnu Gnutls	Version 1.7.1
Gnu Gnutls	Version 1.7.2
Gnu Gnutls	Version 1.7.3
Gnu Gnutls	Version 1.7.4
Gnu Gnutls	Version 1.7.5
Gnu Gnutls	Version 1.7.6
Gnu Gnutls	Version 1.7.7
Gnu Gnutls	Version 1.7.8
Gnu Gnutls	Version 1.7.9
Gnu Gnutls	Version 2.0.0
Gnu Gnutls	Version 2.0.1
Gnu Gnutls	Version 2.0.2
Gnu Gnutls	Version 2.0.3
Gnu Gnutls	Version 2.0.4
Gnu Gnutls	Version 2.1.0
Gnu Gnutls	Version 2.1.1
Gnu Gnutls	Version 2.1.2
Gnu Gnutls	Version 2.1.3
Gnu Gnutls	Version 2.1.4
Gnu Gnutls	Version 2.1.5
Gnu Gnutls	Version 2.1.6
Gnu Gnutls	Version 2.1.7
Gnu Gnutls	Version 2.1.8
Gnu Gnutls	Version 2.10.0
Gnu Gnutls	Version 2.10.1
Gnu Gnutls	Version 2.10.2
Gnu Gnutls	Version 2.10.3
Gnu Gnutls	Version 2.10.4
Gnu Gnutls	Version 2.10.5
Gnu Gnutls	Version 2.12.0
Gnu Gnutls	Version 2.12.10
Gnu Gnutls	Version 2.12.11
Gnu Gnutls	Version 2.12.12
Gnu Gnutls	Version 2.12.13
Gnu Gnutls	Version 2.12.14
Gnu Gnutls	Version 2.12.1
Gnu Gnutls	Version 2.12.2
Gnu Gnutls	Version 2.12.3
Gnu Gnutls	Version 2.12.4
Gnu Gnutls	Version 2.12.5
Gnu Gnutls	Version 2.12.6.1
Gnu Gnutls	Version 2.12.6
Gnu Gnutls	Version 2.12.7
Gnu Gnutls	Version 2.12.8
Gnu Gnutls	Version 2.12.9
Gnu Gnutls	Version 2.2.0
Gnu Gnutls	Version 2.2.1
Gnu Gnutls	Version 2.2.2
Gnu Gnutls	Version 2.2.3
Gnu Gnutls	Version 2.2.4
Gnu Gnutls	Version 2.2.5
Gnu Gnutls	Version 2.3.0
Gnu Gnutls	Version 2.3.10
Gnu Gnutls	Version 2.3.11
Gnu Gnutls	Version 2.3.1
Gnu Gnutls	Version 2.3.2
Gnu Gnutls	Version 2.3.3
Gnu Gnutls	Version 2.3.4
Gnu Gnutls	Version 2.3.5
Gnu Gnutls	Version 2.3.6
Gnu Gnutls	Version 2.3.7
Gnu Gnutls	Version 2.3.8
Gnu Gnutls	Version 2.3.9
Gnu Gnutls	Version 2.4.0
Gnu Gnutls	Version 2.4.1
Gnu Gnutls	Version 2.4.2
Gnu Gnutls	Version 2.4.3
Gnu Gnutls	Version 2.5.0
Gnu Gnutls	Version 2.6.0
Gnu Gnutls	Version 2.6.1
Gnu Gnutls	Version 2.6.2
Gnu Gnutls	Version 2.6.3
Gnu Gnutls	Version 2.6.4
Gnu Gnutls	Version 2.6.5
Gnu Gnutls	Version 2.6.6
Gnu Gnutls	Version 2.7.4
Gnu Gnutls	Version 2.8.0
Gnu Gnutls	Version 2.8.1
Gnu Gnutls	Version 2.8.2
Gnu Gnutls	Version 2.8.3
Gnu Gnutls	Version 2.8.4
Gnu Gnutls	Version 2.8.5
Gnu Gnutls	Version 2.8.6
Gnu Gnutls	Version 3.0.0
Gnu Gnutls	Version 3.0.10
Gnu Gnutls	Version 3.0.11
Gnu Gnutls	Version 3.0.12
Gnu Gnutls	Version 3.0.13
Gnu Gnutls	Version 3.0.14
Gnu Gnutls	Version 3.0.1
Gnu Gnutls	Version 3.0.2
Gnu Gnutls	Version 3.0.3
Gnu Gnutls	Version 3.0.4
Gnu Gnutls	Version 3.0.5
Gnu Gnutls	Version 3.0.6
Gnu Gnutls	Version 3.0.7
Gnu Gnutls	Version 3.0.8
Gnu Gnutls	Version 3.0.9
Gnu Gnutls	Version 3.0
Gnu Libtasn1	Up to 2.11
Gnu Libtasn1	Version 0.1.0
Gnu Libtasn1	Version 0.1.1
Gnu Libtasn1	Version 0.1.2
Gnu Libtasn1	Version 0.2.0
Gnu Libtasn1	Version 0.2.10
Gnu Libtasn1	Version 0.2.11
Gnu Libtasn1	Version 0.2.12
Gnu Libtasn1	Version 0.2.13
Gnu Libtasn1	Version 0.2.14
Gnu Libtasn1	Version 0.2.15
Gnu Libtasn1	Version 0.2.16
Gnu Libtasn1	Version 0.2.17
Gnu Libtasn1	Version 0.2.18
Gnu Libtasn1	Version 0.2.1
Gnu Libtasn1	Version 0.2.2
Gnu Libtasn1	Version 0.2.3
Gnu Libtasn1	Version 0.2.4
Gnu Libtasn1	Version 0.2.5
Gnu Libtasn1	Version 0.2.6
Gnu Libtasn1	Version 0.2.7
Gnu Libtasn1	Version 0.2.8
Gnu Libtasn1	Version 0.2.9
Gnu Libtasn1	Version 0.3.0
Gnu Libtasn1	Version 0.3.10
Gnu Libtasn1	Version 0.3.1
Gnu Libtasn1	Version 0.3.2
Gnu Libtasn1	Version 0.3.3
Gnu Libtasn1	Version 0.3.4
Gnu Libtasn1	Version 0.3.5
Gnu Libtasn1	Version 0.3.6
Gnu Libtasn1	Version 0.3.7
Gnu Libtasn1	Version 0.3.8
Gnu Libtasn1	Version 0.3.9
Gnu Libtasn1	Version 1.0
Gnu Libtasn1	Version 1.1
Gnu Libtasn1	Version 1.2
Gnu Libtasn1	Version 1.3
Gnu Libtasn1	Version 1.4
Gnu Libtasn1	Version 1.5
Gnu Libtasn1	Version 1.6
Gnu Libtasn1	Version 1.7
Gnu Libtasn1	Version 1.8
Gnu Libtasn1	Version 2.0
Gnu Libtasn1	Version 2.10
Gnu Libtasn1	Version 2.1
Gnu Libtasn1	Version 2.2
Gnu Libtasn1	Version 2.3
Gnu Libtasn1	Version 2.4
Gnu Libtasn1	Version 2.5
Gnu Libtasn1	Version 2.6
Gnu Libtasn1	Version 2.7
Gnu Libtasn1	Version 2.8
Gnu Libtasn1	Version 2.9

Related CWEs

CWE-189

References (66)

http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html

Source: secalert@redhat.com

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932

Source: secalert@redhat.com

Patch

http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53

Source: secalert@redhat.com

http://article.gmane.org/gmane.comp.gnu.libtasn1.general/54

Source: secalert@redhat.com

http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/

Source: secalert@redhat.com

Exploit

http://linux.oracle.com/errata/ELSA-2014-0596.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076856.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076865.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077284.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077339.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078207.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076699.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0427.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0488.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0531.html

Source: secalert@redhat.com

http://secunia.com/advisories/48397

Source: secalert@redhat.com

http://secunia.com/advisories/48488

Source: secalert@redhat.com

http://secunia.com/advisories/48505

Source: secalert@redhat.com

http://secunia.com/advisories/48578

Source: secalert@redhat.com

http://secunia.com/advisories/48596

Source: secalert@redhat.com

http://secunia.com/advisories/49002

Source: secalert@redhat.com

http://secunia.com/advisories/50739

Source: secalert@redhat.com

http://secunia.com/advisories/57260

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2440

Source: secalert@redhat.com

http://www.gnu.org/software/gnutls/security.html

Source: secalert@redhat.com

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:039

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/03/20/3

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/03/20/8

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/03/21/5

Source: secalert@redhat.com

http://www.securitytracker.com/id?1026829

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1436-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=804920

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html