1. CVE-Search
  2. CVE-2006-0645
ID CVE-2006-0645
Summary Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.
References
Vulnerable Configurations
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.10:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.10:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.11:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.11:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.12:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.12:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.13:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.13:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.14:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.14:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.15:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.15:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.16:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.16:*:*:*:*:*:*:*
  • cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.17:*:*:*:*:*:*:*
    cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.17:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 19-10-2018 - 15:45)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:06:33.154-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.
family unix
id oval:org.mitre.oval:def:10540
status accepted
submitted 2010-07-09T03:56:16-04:00
title Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.
version 29
redhat via4
advisories
bugzilla
id 184097
title CVE-2006-0645 - libtasn1 buffer overflow
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • OR
      • AND
        • comment gnutls is earlier than 0:1.0.20-3.2.2
          oval oval:com.redhat.rhsa:tst:20060207001
        • comment gnutls is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060207002
      • AND
        • comment gnutls-devel is earlier than 0:1.0.20-3.2.2
          oval oval:com.redhat.rhsa:tst:20060207003
        • comment gnutls-devel is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060207004
rhsa
id RHSA-2006:0207
released 2006-02-10
severity Important
title RHSA-2006:0207: gnutls security update (Important)
rpms
  • gnutls-0:1.0.20-3.2.2
  • gnutls-debuginfo-0:1.0.20-3.2.2
  • gnutls-devel-0:1.0.20-3.2.2
refmap via4
bid 16568
bugtraq 20060209 ProtoVer SSL: GnuTLS
confirm http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup
debian
  • DSA-985
  • DSA-986
fedora FEDORA-2006-107
gentoo GLSA-200602-08
mandriva MDKSA-2006:039
misc
mlist
  • [gnutls-dev] 20060209 GnuTLS 1.2.10 - Security release
  • [gnutls-dev] 20060209 GnuTLS 1.3.4 - Experimental - Security release
  • [gnutls-dev] 20060209 Libtasn1 0.2.18 - Tiny ASN.1 Library - Security release
osvdb 23054
sectrack 1015612
secunia
  • 18794
  • 18815
  • 18830
  • 18832
  • 18898
  • 18918
  • 19080
  • 19092
sreason 446
trustix 2006-0008
ubuntu USN-251-1
vupen ADV-2006-0496
xf gnutls-libtasn1-der-dos(24606)
Last major update 19-10-2018 - 15:45
Published 10-02-2006 - 18:06
Last modified 19-10-2018 - 15:45
Back to Top