CVE-2012-1573

Published: Mar 26, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

Affected (92)

Products: Gnu: Gnutls

1 product

Configuration A

76 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Up to 2.12.16
Gnu Gnutls	Version 2.0.0
Gnu Gnutls	Version 2.0.1
Gnu Gnutls	Version 2.0.2
Gnu Gnutls	Version 2.0.3
Gnu Gnutls	Version 2.0.4
Gnu Gnutls	Version 2.1.0
Gnu Gnutls	Version 2.1.1
Gnu Gnutls	Version 2.1.2
Gnu Gnutls	Version 2.1.3
Gnu Gnutls	Version 2.1.4
Gnu Gnutls	Version 2.1.5
Gnu Gnutls	Version 2.1.6
Gnu Gnutls	Version 2.1.7
Gnu Gnutls	Version 2.1.8
Gnu Gnutls	Version 2.10.0
Gnu Gnutls	Version 2.10.1
Gnu Gnutls	Version 2.10.2
Gnu Gnutls	Version 2.10.3
Gnu Gnutls	Version 2.10.4
Gnu Gnutls	Version 2.10.5
Gnu Gnutls	Version 2.12.0
Gnu Gnutls	Version 2.12.10
Gnu Gnutls	Version 2.12.11
Gnu Gnutls	Version 2.12.12
Gnu Gnutls	Version 2.12.13
Gnu Gnutls	Version 2.12.14
Gnu Gnutls	Version 2.12.15
Gnu Gnutls	Version 2.12.1
Gnu Gnutls	Version 2.12.2
Gnu Gnutls	Version 2.12.3
Gnu Gnutls	Version 2.12.4
Gnu Gnutls	Version 2.12.5
Gnu Gnutls	Version 2.12.6.1
Gnu Gnutls	Version 2.12.6
Gnu Gnutls	Version 2.12.7
Gnu Gnutls	Version 2.12.8
Gnu Gnutls	Version 2.12.9
Gnu Gnutls	Version 2.2.0
Gnu Gnutls	Version 2.2.1
Gnu Gnutls	Version 2.2.2
Gnu Gnutls	Version 2.2.3
Gnu Gnutls	Version 2.2.4
Gnu Gnutls	Version 2.2.5
Gnu Gnutls	Version 2.3.0
Gnu Gnutls	Version 2.3.10
Gnu Gnutls	Version 2.3.11
Gnu Gnutls	Version 2.3.1
Gnu Gnutls	Version 2.3.2
Gnu Gnutls	Version 2.3.3
Gnu Gnutls	Version 2.3.4
Gnu Gnutls	Version 2.3.5
Gnu Gnutls	Version 2.3.6
Gnu Gnutls	Version 2.3.7
Gnu Gnutls	Version 2.3.8
Gnu Gnutls	Version 2.3.9
Gnu Gnutls	Version 2.4.0
Gnu Gnutls	Version 2.4.1
Gnu Gnutls	Version 2.4.2
Gnu Gnutls	Version 2.4.3
Gnu Gnutls	Version 2.5.0
Gnu Gnutls	Version 2.6.0
Gnu Gnutls	Version 2.6.1
Gnu Gnutls	Version 2.6.2
Gnu Gnutls	Version 2.6.3
Gnu Gnutls	Version 2.6.4
Gnu Gnutls	Version 2.6.5
Gnu Gnutls	Version 2.6.6
Gnu Gnutls	Version 2.7.4
Gnu Gnutls	Version 2.8.0
Gnu Gnutls	Version 2.8.1
Gnu Gnutls	Version 2.8.2
Gnu Gnutls	Version 2.8.3
Gnu Gnutls	Version 2.8.4
Gnu Gnutls	Version 2.8.5
Gnu Gnutls	Version 2.8.6

Configuration B

16 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Version 3.0.0
Gnu Gnutls	Version 3.0.10
Gnu Gnutls	Version 3.0.11
Gnu Gnutls	Version 3.0.12
Gnu Gnutls	Version 3.0.13
Gnu Gnutls	Version 3.0.14
Gnu Gnutls	Version 3.0.1
Gnu Gnutls	Version 3.0.2
Gnu Gnutls	Version 3.0.3
Gnu Gnutls	Version 3.0.4
Gnu Gnutls	Version 3.0.5
Gnu Gnutls	Version 3.0.6
Gnu Gnutls	Version 3.0.7
Gnu Gnutls	Version 3.0.8
Gnu Gnutls	Version 3.0.9
Gnu Gnutls	Version 3.0

Related CWEs

References (54)

http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html

Source: secalert@redhat.com

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910

Source: secalert@redhat.com

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912

Source: secalert@redhat.com

http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/

Source: secalert@redhat.com

Exploit

http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=422214868061370aeeb0ac9cd0f021a5c350a57d

Source: secalert@redhat.com

http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: secalert@redhat.com

http://osvdb.org/80259

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0429.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0488.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0531.html

Source: secalert@redhat.com

http://secunia.com/advisories/48488

Source: secalert@redhat.com

http://secunia.com/advisories/48511

Source: secalert@redhat.com

http://secunia.com/advisories/48596

Source: secalert@redhat.com

http://secunia.com/advisories/48712

Source: secalert@redhat.com

http://secunia.com/advisories/57260

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2441

Source: secalert@redhat.com

http://www.gnu.org/software/gnutls/security.html

Source: secalert@redhat.com

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:040

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/03/21/4

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/03/21/5

Source: secalert@redhat.com

http://www.securityfocus.com/bid/52667

Source: secalert@redhat.com

http://www.securitytracker.com/id?1026828

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1418-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=805432

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910

Source: af854a3a-2127-422b-91ae-364da2661108

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912

Source: af854a3a-2127-422b-91ae-364da2661108

http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=422214868061370aeeb0ac9cd0f021a5c350a57d

Source: af854a3a-2127-422b-91ae-364da2661108

http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/80259

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0429.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0488.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-0531.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48488

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48511

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48596

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48712

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57260

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2012/dsa-2441

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.gnu.org/software/gnutls/security.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2012:040

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2012/03/21/4

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2012/03/21/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/52667

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1026828

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1418-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=805432

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.