Title : GnuTLS "gnutls_handshake()" Use-after-free Vulnerability VUPEN ID : VUPEN/ADV-2008-2398 CVE ID : CVE-2008-2377 CWE ID : CWE-416
Rated as : Moderate Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2008-08-18
Technical Description
A vulnerability has been identified in GnuTLS, which could be exploited by attackers to cause a denial of service or compromise a vulnerable system. This issue is caused by a use after free error in the "_gnutls_handshake_hash_buffers_clear()" [lib/gnutls_handshake.c] function when a peer calls "gnutls_handshake" within a normal session, which could cause the libgnutls libray to attempt to access to a deallocated libgcrypt handle, leading to a crash.
