fkie_cve-2006-0645
Vulnerability from fkie_nvd
Published
2006-02-10 18:06
Modified
2025-04-03 01:03
Severity ?
Summary
Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.
References
secalert@redhat.comhttp://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup
secalert@redhat.comhttp://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup
secalert@redhat.comhttp://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch
secalert@redhat.comhttp://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html
secalert@redhat.comhttp://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html
secalert@redhat.comhttp://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2006-0207.html
secalert@redhat.comhttp://secunia.com/advisories/18794
secalert@redhat.comhttp://secunia.com/advisories/18815
secalert@redhat.comhttp://secunia.com/advisories/18830
secalert@redhat.comhttp://secunia.com/advisories/18832
secalert@redhat.comhttp://secunia.com/advisories/18898
secalert@redhat.comhttp://secunia.com/advisories/18918
secalert@redhat.comhttp://secunia.com/advisories/19080
secalert@redhat.comhttp://secunia.com/advisories/19092
secalert@redhat.comhttp://securityreason.com/securityalert/446
secalert@redhat.comhttp://securitytracker.com/id?1015612
secalert@redhat.comhttp://www.debian.org/security/2006/dsa-985
secalert@redhat.comhttp://www.debian.org/security/2006/dsa-986
secalert@redhat.comhttp://www.gentoo.org/security/en/glsa/glsa-200602-08.xml
secalert@redhat.comhttp://www.gleg.net/protover_ssl.shtml
secalert@redhat.comhttp://www.mandriva.com/security/advisories?name=MDKSA-2006:039
secalert@redhat.comhttp://www.osvdb.org/23054
secalert@redhat.comhttp://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html
secalert@redhat.comhttp://www.securityfocus.com/archive/1/424538/100/0/threaded
secalert@redhat.comhttp://www.securityfocus.com/bid/16568
secalert@redhat.comhttp://www.trustix.org/errata/2006/0008
secalert@redhat.comhttp://www.vupen.com/english/advisories/2006/0496
secalert@redhat.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/24606
secalert@redhat.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540
secalert@redhat.comhttps://usn.ubuntu.com/251-1/
af854a3a-2127-422b-91ae-364da2661108http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup
af854a3a-2127-422b-91ae-364da2661108http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup
af854a3a-2127-422b-91ae-364da2661108http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch
af854a3a-2127-422b-91ae-364da2661108http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html
af854a3a-2127-422b-91ae-364da2661108http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html
af854a3a-2127-422b-91ae-364da2661108http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2006-0207.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18794
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18815
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18830
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18832
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18898
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/18918
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19080
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/19092
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/446
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1015612
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2006/dsa-985
af854a3a-2127-422b-91ae-364da2661108http://www.debian.org/security/2006/dsa-986
af854a3a-2127-422b-91ae-364da2661108http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml
af854a3a-2127-422b-91ae-364da2661108http://www.gleg.net/protover_ssl.shtml
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDKSA-2006:039
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/23054
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/424538/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/16568
af854a3a-2127-422b-91ae-364da2661108http://www.trustix.org/errata/2006/0008
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2006/0496
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/24606
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540
af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/251-1/



{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D499D565-3346-470E-BA08-B894C85B0312",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "03BD64EF-3350-4C9B-AC99-FF920D469749",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "3003BBC5-47C2-4420-93C9-67144BD7E0F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D263ACB-5F52-4E89-A2C2-2D34603221D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D8D228B3-3B1D-49B0-A6E2-047D10F26297",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "27DD62D0-E4C8-4198-A00E-3F9061029A26",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E9C3DA5-B783-4295-B5FA-7C5EAEEAD302",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DAF60A33-0EAD-4A76-B863-80A3B033705D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F145DEE-054A-45BB-B4FB-6421F99150BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "FE3FD24E-DCE0-4228-B94D-9EE2DF151BC3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "751C6875-E572-4374-97F0-9E6C93BA7B31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "0EAA0716-91A0-4EBD-A836-2CF57F77B158",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "B3A4EA1F-785D-4F26-8C60-622DC92D5019",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "C22677DF-9598-47EF-8808-FB59138F6195",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "1222294B-6698-47A6-9C4F-60EAA4F97D27",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "A787FA74-6C38-4992-A68F-5AD5281A0B78",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E454AAA-CA25-45D4-B5B0-D66F1B425E29",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "4452648C-2AB8-43E5-8617-00134E48C7EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "73FA90F4-F2FE-47FA-8F8F-150274082981",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "C48CE0BF-19FA-48AE-866E-3AD4E8B6806A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:free_software_foundation_inc.:libtasn1:0.2.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC9AD82D-5320-4D1B-B222-BC7F507D9CB4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via \"out-of-bounds access\" caused by invalid input, as demonstrated by the ProtoVer SSL test suite."
    }
  ],
  "id": "CVE-2006-0645",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2006-02-10T18:06:00.000",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror\u0026view=markup"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0207.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/18794"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/18815"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/18830"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/18832"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/18898"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/18918"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/19080"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/19092"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securityreason.com/securityalert/446"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://securitytracker.com/id?1015612"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.debian.org/security/2006/dsa-985"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.debian.org/security/2006/dsa-986"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.gleg.net/protover_ssl.shtml"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:039"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.osvdb.org/23054"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/archive/1/424538/100/0/threaded"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/16568"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.trustix.org/errata/2006/0008"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2006/0496"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24606"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://usn.ubuntu.com/251-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror\u0026view=markup"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2006-0207.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18794"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18815"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18830"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18832"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18898"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/18918"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19080"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/19092"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/446"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1015612"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2006/dsa-985"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2006/dsa-986"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.gleg.net/protover_ssl.shtml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2006:039"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/23054"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/424538/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/16568"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.trustix.org/errata/2006/0008"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/0496"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24606"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://usn.ubuntu.com/251-1/"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…