GnuTLS Client Hello repeat Denial of Service

Overview A vulnerability exists in GnuTLS that may allow a remote attacker to cause a denial of service. Description GnuTLS contains a vulnerability in gnults-serv that may result in a denial of service when handling a specially crafted TLS packet that contains multiple Client Hello messages...

Debian: Security Advisory (DSA-1571-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1581-1 (gnutls13)

The remote host is missing an update to gnutls13 announced via advisory DSA 1581-1. OpenVAS Vulnerability Test $Id: deb15811.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 1581-1 gnutls13 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

gnutls security update

CentOS Errata and Security Advisory CESA-2008:0492 Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The GnuTLS Library provides support f...

GnuTLS堆溢出及拒绝服务漏洞

BUGTRAQ ID: 29292 CVECAN ID: CVE-2008-1948,CVE-2008-1949,CVE-2008-1950 GnuTLS是用于实现TLS加密协议的函数库。 GnuTLS在处理各种畸形TLS报文时存在多个安全漏洞，可能导致拒绝服务或完全入侵运行该库应用程序所在的操作系统。 如果用户所发送的Client Hello消息包含有Server Name扩展的话，就可能在lib/extservername.c文件的gnutlsservernamerecvparams函数中触发堆溢出，导致执行任意代码。...

GLSA-200805-20 : GnuTLS: Execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-200805-20 GnuTLS: Execution of arbitrary code Ossi Herrala and Jukka Taimisto of Codenomicon reported three vulnerabilities in libgnutls of GnuTLS: 'Client Hello' messages containing an invalid server name can lead to a buffer...

Fedora 8 : gnutls-1.6.3-3.fc8 (2008-4183)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

Fedora 7 : gnutls-1.6.3-3.fc7 (2008-4274)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

Fedora 9 : gnutls-2.0.4-3.fc9 (2008-4259)

Fixes critical security issue GNUTLS-SA-2008-1 described here: http://lists.gnu.org/archive/html/gnutls-devel/2008-05/msg00060.html All applications and system services which utilize gnutls library must be restarted for the updates to take effect. Note that Tenable Network Security has extracted...

RHEL 5 : gnutls (RHSA-2008:0489)

Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The GnuTLS Library provides support for cryptographic algorithms and protocols such as TL...

RHEL 4 : gnutls (RHSA-2008:0492)

Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The GnuTLS Library provides support for cryptographic algorithms and protocols such as...

Debian DSA-1581-1 : gnutls13 - several vulnerabilities

Several remote vulnerabilities have been discovered in GNUTLS, an implementation of the SSL/TLS protocol suite. NOTE: The libgnutls13 package, which provides the GNUTLS library, does not contain logic to automatically restart potentially affected services. You must restart affected services...

gnutls security update

CentOS Errata and Security Advisory CESA-2008:0489 Updated gnutls packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. The GnuTLS Library provides support fo...

Buffer overflow

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

Integer overflow

Integer signedness error in the gnutlsciphertext2compressed function in lib/gnutlscipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service buffer over-read and crash via a certain integer value in the Random field in an encrypted Client Hello message withi...

CVE-2008-1949

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...

CVE-2008-1948

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

CVE-2008-1949

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...

CVE-2008-1948

The gnutlsservernamerecvparams function in lib/extservername.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service crash or...

Design/Logic Flaw

The gnutlsrecvclientkxmessage function in lib/gnutlskx.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 continues to process Client Hello messages within a TLS message after one has already been processed, which allows remote attackers to cause a denial of service NULL dereference and crash v...