GnuTLS record packet parsing denial of service
| gnutls-record-parsing-dos (20328) |  Low Risk |
Description:
Gnu Transport Layer Security Library (GnuTLS) is vulnerable to a denial of service attack caused by a unspecified vulnerability in the record packet parsing.
Platforms Affected:
- Canonical, Ubuntu 4.10
- Canonical, Ubuntu 5.04
- Gentoo, Linux
- GNU, GnuTLS 1.0.18
- GNU, GnuTLS 1.0.19
- GNU, GnuTLS 1.0.20
- GNU, GnuTLS 1.0.21
- GNU, GnuTLS 1.0.22
- GNU, GnuTLS 1.0.23
- GNU, GnuTLS 1.0.24
- GNU, GnuTLS 1.2.0
- GNU, GnuTLS 1.2.1
- GNU, GnuTLS 1.2.2
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux LE2005 X86_64
- MandrakeSoft, Mandrake Linux LE2005
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 Desktop
Remedy:
Upgrade to the latest version of GnuTLS (1.0.25 or 1.2.3 or later), available from the GnuTLS Web page. See References.
For Ubuntu Linux:
Upgrade to the latest version of gnutls10 or gnutls11 (1.0.4-3ubuntu1.1 or 1.0.16-13ubuntu0.1 or later), as listed in USN-126-1. See References.
For Gentoo Linux:
Upgrade the latest version of GnuTLS (1.2.3 or later), as listed in Gentoo Linux Security Announcement GLSA 200505-04. See Reference.
For Red Hat Linux:
Refer to RHSA-2005:430-05 for patch, upgrade, or suggested workaround information. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Denial of Service
References:
- GnuTLS Web page, The GNU Transport Layer Security Library at http://www.gnu.org/software/gnutls/.
- BID-13477: GNUTLS Padding Denial of Service Vulnerability
- CVE-2005-1431: The record packet parsing in GnuTLS 1.2 before 1.2.3 and 1.0 before 1.0.25 allows remote attackers to cause a denial of service, possibly related to padding bytes in gnutils_cipher.c.
- GLSA-200505-04: GnuTLS: Denial of Service vulnerability
- MDKSA-2005:084: Updated gnutls packages fix vulnerabilities
- OSVDB ID: 16054: GnuTLS Record Packet Parsing Unspecified DoS
- RHSA-2005-430: gnutls security update
- SA15193: GnuTLS Record Packet Parsing Denial of Service Vulnerability
- SECTRACK ID: 1013861: GnuTLS Padding Validation Error Lets Remote Users Deny Service
- USN-126-1: GNU TLS library vulnerability
Reported:
May 02, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net