CVE-2014-3466

Published: Jun 3, 2014Modified: May 6, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.

Affected (47)

Products: Gnu: Gnutls

Gnu

1 product

Gnutls

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Version 3.3.0
Gnu Gnutls	Version 3.3.0 pre0
Gnu Gnutls	Version 3.3.1
Gnu Gnutls	Version 3.3.2
Gnu Gnutls	Version 3.3.3

Configuration B

25 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Up to 3.1.24
Gnu Gnutls	Version 3.1.0
Gnu Gnutls	Version 3.1.10
Gnu Gnutls	Version 3.1.11
Gnu Gnutls	Version 3.1.12
Gnu Gnutls	Version 3.1.13
Gnu Gnutls	Version 3.1.14
Gnu Gnutls	Version 3.1.15
Gnu Gnutls	Version 3.1.16
Gnu Gnutls	Version 3.1.17
Gnu Gnutls	Version 3.1.18
Gnu Gnutls	Version 3.1.19
Gnu Gnutls	Version 3.1.1
Gnu Gnutls	Version 3.1.20
Gnu Gnutls	Version 3.1.21
Gnu Gnutls	Version 3.1.22
Gnu Gnutls	Version 3.1.23
Gnu Gnutls	Version 3.1.2
Gnu Gnutls	Version 3.1.3
Gnu Gnutls	Version 3.1.4
Gnu Gnutls	Version 3.1.5
Gnu Gnutls	Version 3.1.6
Gnu Gnutls	Version 3.1.7
Gnu Gnutls	Version 3.1.8
Gnu Gnutls	Version 3.1.9

Configuration C

17 vulnerable

Vulnerable Software	Affected Versions
Gnu Gnutls	Version 3.2.0
Gnu Gnutls	Version 3.2.10
Gnu Gnutls	Version 3.2.11
Gnu Gnutls	Version 3.2.12.1
Gnu Gnutls	Version 3.2.12
Gnu Gnutls	Version 3.2.13
Gnu Gnutls	Version 3.2.14
Gnu Gnutls	Version 3.2.1
Gnu Gnutls	Version 3.2.2
Gnu Gnutls	Version 3.2.3
Gnu Gnutls	Version 3.2.4
Gnu Gnutls	Version 3.2.5
Gnu Gnutls	Version 3.2.6
Gnu Gnutls	Version 3.2.7
Gnu Gnutls	Version 3.2.8.1
Gnu Gnutls	Version 3.2.8
Gnu Gnutls	Version 3.2.9

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (66)

http://linux.oracle.com/errata/ELSA-2014-0594.html

Source: secalert@redhat.com

http://linux.oracle.com/errata/ELSA-2014-0595.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00007.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00010.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00015.html

Source: secalert@redhat.com

http://radare.today/technical-analysis-of-the-gnutls-hello-vulnerability/

Source: secalert@redhat.com

ExploitURL Repurposed

http://rhn.redhat.com/errata/RHSA-2014-0594.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0595.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0684.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2014-0815.html

Source: secalert@redhat.com

http://secunia.com/advisories/58340

Source: secalert@redhat.com

http://secunia.com/advisories/58598

Source: secalert@redhat.com

http://secunia.com/advisories/58601

Source: secalert@redhat.com

http://secunia.com/advisories/58642

Source: secalert@redhat.com

http://secunia.com/advisories/59016

Source: secalert@redhat.com

http://secunia.com/advisories/59021

Source: secalert@redhat.com

http://secunia.com/advisories/59057

Source: secalert@redhat.com

http://secunia.com/advisories/59086

Source: secalert@redhat.com

http://secunia.com/advisories/59408

Source: secalert@redhat.com

http://secunia.com/advisories/59838

Source: secalert@redhat.com

http://secunia.com/advisories/60384

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=swg21678776

Source: secalert@redhat.com

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096155

Source: secalert@redhat.com

http://www.debian.org/security/2014/dsa-2944

Source: secalert@redhat.com

http://www.gnutls.org/security.html

Source: secalert@redhat.com

Vendor Advisory

http://www.novell.com/support/kb/doc.php?id=7015302

Source: secalert@redhat.com

http://www.novell.com/support/kb/doc.php?id=7015303

Source: secalert@redhat.com

http://www.securityfocus.com/bid/67741

Source: secalert@redhat.com

http://www.securitytracker.com/id/1030314

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2229-1

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1101932

Source: secalert@redhat.com

https://www.gitorious.org/gnutls/gnutls/commit/688ea6428a432c39203d00acd1af0e7684e5ddfd

Source: secalert@redhat.com

ExploitPatch

http://linux.oracle.com/errata/ELSA-2014-0594.html