>> GnuTLS Data Handling Buffer Overflow and Denial of Service Issues
Title : GnuTLS Data Handling Buffer Overflow and Denial of Service Issues VUPEN ID : VUPEN/ADV-2008-1582 CVE ID : CVE-2008-1948 - CVE-2008-1949 - CVE-2008-1950
Rated as : High Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2008-05-21
Technical Description
Multiple vulnerabilities have been identified in GnuTLS, which could be exploited by remote attackers to cause a denial of service or compromise an affected system.
The first issue is caused by a NULL pointer dereference error when processing TLS packets containing multiple "Client Hello" messages, which could be exploited by unauthenticated attackers to crash a vulnerable application.
The second vulnerability is caused by a buffer overflow error when processing certain "Client Hello" messages containing a Server name extension, which could be exploited by unauthenticated attackers to crash an affected application or execute arbitrary code.
The third issue is caused by an error in the "_gnutls_ciphertext2compressed()" [lib/gnutls_cipher.c] function when handling encrypted TLS data containig invalid Record lengths, which could be exploited by unauthenticated remote attackers to crash a vulnerable application.
