fkie_cve-2010-0731
Vulnerability from fkie_nvd
Published
2010-03-26 18:30
Modified
2025-04-11 00:51
Severity ?
Summary
The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.
References
secalert@redhat.comhttp://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
secalert@redhat.comhttp://secunia.com/advisories/39127
secalert@redhat.comhttp://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230Exploit
secalert@redhat.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2010:089
secalert@redhat.comhttp://www.redhat.com/support/errata/RHSA-2010-0167.html
secalert@redhat.comhttp://www.securityfocus.com/bid/38959
secalert@redhat.comhttp://www.vupen.com/english/advisories/2010/0713Patch, Vendor Advisory
secalert@redhat.comhttp://www.vupen.com/english/advisories/2010/1054
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=573028Exploit
secalert@redhat.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/39127
af854a3a-2127-422b-91ae-364da2661108http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2010:089
af854a3a-2127-422b-91ae-364da2661108http://www.redhat.com/support/errata/RHSA-2010-0167.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/38959
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/0713Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/1054
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=573028Exploit
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759
Impacted products
Vendor Product Version
gnu gnutls *
gnu gnutls 1.0.16
gnu gnutls 1.0.17
gnu gnutls 1.0.18
gnu gnutls 1.0.19
gnu gnutls 1.0.20
gnu gnutls 1.0.21
gnu gnutls 1.0.22
gnu gnutls 1.0.23
gnu gnutls 1.0.24
gnu gnutls 1.0.25
gnu gnutls 1.1.13
gnu gnutls 1.1.14
gnu gnutls 1.1.15
gnu gnutls 1.1.16
gnu gnutls 1.1.17
gnu gnutls 1.1.18
gnu gnutls 1.1.19
gnu gnutls 1.1.20
gnu gnutls 1.1.21
gnu gnutls 1.1.22
gnu gnutls 1.1.23


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E314F586-A086-480E-9BB9-D75ADDF8416D",
              "versionEndIncluding": "1.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "4FBB8F2C-498D-4D31-A7D7-9991BABEA7A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "8856E1B1-8007-42E5-82EF-4700D4DEEDDA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9CF40D3-CE03-4C2A-8EEF-EB5989291806",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC60D4CC-922C-4941-A400-0CBEAC7F31D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "754A0D19-A17A-4007-8355-497D14CFCBF9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "8140DBE1-8116-4051-9A57-07535586E0AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "56D2DF7F-DCDD-486D-B906-F9DDE3A1DB70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1CC840D-AD01-4EE2-8652-06742A6286BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "84224A82-6D58-4000-A449-20C1632DAE85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "A466931C-769A-4A28-B072-10930CE655E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FEE50AC-8730-4F04-B57C-6BDF8B957F6D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "10F621DC-7967-4D97-A562-02E7033C89C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "776E5481-399F-45BC-AD20-A18508B03916",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "63D7F972-9128-4A4D-8508-B38CE2F155E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5D56873-E8C5-4E4B-BB85-6DCF6526B453",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "54FE4766-32D0-491E-8C71-5B998C468142",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F980857-2364-466A-8366-BD017D242222",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "4CDCF1F0-5A78-48FF-B4B0-303AE2420F6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A2E649D-5C45-4412-927B-E3EDCE07587C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "066175C2-6E96-4BAE-B1A6-B23D25547FAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "869D3010-67AE-44D0-BB8F-D9C410AEA1D8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n gnutls_x509_crt_get_serial en la librer\u00eda GnuTLS anterior a v1.2.1, cunado se est\u00e1 ejecutando sobre big-endian, plataformas de 64-bit, llama de a asn1_read_value con un puntero a un tipo de dato err\u00f3neo, y con una longitud err\u00f3nea, lo que permite a atacantes remotos saltarse el control la lista de certificados revocados (CRL) y robocar un desbordamiento de de b\u00fafer basado en pila, a a trav\u00e9s de un certificado X.509 manipulado, relativo a la extracci\u00f3n de un n\u00famero de serie."
    }
  ],
  "evaluatorSolution": "Per: http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230\r\n\r\n\"Please note that the problem was solved for GnuTLS 1.2.1, released on\r\n2005-04-04.  Also, 32-bit platforms are not affected.  I have added\r\ninformation about this on\r\n\r\nhttp://www.gnu.org/software/gnutls/security.html\r\n\r\nso that it contains the complete list of known security flaws.  I\u0027m\r\nusing the keyword GNUTLS-SA-2010-1 for this.\"",
  "id": "CVE-2010-0731",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2010-03-26T18:30:00.437",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/39127"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit"
      ],
      "url": "http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0167.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/38959"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/0713"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.vupen.com/english/advisories/2010/1054"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=573028"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/39127"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0167.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/38959"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2010/0713"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2010/1054"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=573028"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.