Think you have a false positive on this rule?

Sid 1-24996

Message

SERVER-OTHER Free Software Foundation GnuTLS record application integer overflow attempt

Summary

gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

Impact

CVSS base score 5.0 CVSS impact score 2.9 CVSS exploitability score 10.0 confidentialityImpact NONE integrityImpact NONE availabilityImpact NONE

CVE-2012-1573:

CVSS base score 5.0

CVSS impact score 2.9

CVSS exploitability score 10.0

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

Detailed information

CVE-2012-1573: gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.

Affected systems

  • gnu gnutls 2.0.0
  • gnu gnutls 2.0.1
  • gnu gnutls 2.0.2
  • gnu gnutls 2.0.3
  • gnu gnutls 2.0.4
  • gnu gnutls 2.1.0
  • gnu gnutls 2.1.1
  • gnu gnutls 2.1.2
  • gnu gnutls 2.1.3
  • gnu gnutls 2.1.4
  • gnu gnutls 2.1.5
  • gnu gnutls 2.1.6
  • gnu gnutls 2.1.7
  • gnu gnutls 2.1.8
  • gnu gnutls 2.2.0
  • gnu gnutls 2.2.1
  • gnu gnutls 2.2.2
  • gnu gnutls 2.2.3
  • gnu gnutls 2.2.4
  • gnu gnutls 2.2.5
  • gnu gnutls 2.3.0
  • gnu gnutls 2.3.1
  • gnu gnutls 2.3.2
  • gnu gnutls 2.3.3
  • gnu gnutls 2.3.4
  • gnu gnutls 2.3.5
  • gnu gnutls 2.3.6
  • gnu gnutls 2.3.7
  • gnu gnutls 2.3.8
  • gnu gnutls 2.3.9
  • gnu gnutls 2.3.10
  • gnu gnutls 2.3.11
  • gnu gnutls 2.4.0
  • gnu gnutls 2.4.1
  • gnu gnutls 2.4.2
  • gnu gnutls 2.4.3
  • gnu gnutls 2.5.0
  • gnu gnutls 2.6.0
  • gnu gnutls 2.6.1
  • gnu gnutls 2.6.2
  • gnu gnutls 2.6.3
  • gnu gnutls 2.6.4
  • gnu gnutls 2.6.5
  • gnu gnutls 2.6.6
  • gnu gnutls 2.7.4
  • gnu gnutls 2.8.0
  • gnu gnutls 2.8.1
  • gnu gnutls 2.8.2
  • gnu gnutls 2.8.3
  • gnu gnutls 2.8.4
  • gnu gnutls 2.8.5
  • gnu gnutls 2.8.6
  • gnu gnutls 2.10.0
  • gnu gnutls 2.10.1
  • gnu gnutls 2.10.2
  • gnu gnutls 2.10.3
  • gnu gnutls 2.10.4
  • gnu gnutls 2.10.5
  • gnu gnutls 2.12.0
  • gnu gnutls 2.12.1
  • gnu gnutls 2.12.2
  • gnu gnutls 2.12.3
  • gnu gnutls 2.12.4
  • gnu gnutls 2.12.5
  • gnu gnutls 2.12.6
  • gnu gnutls 2.12.6.1
  • gnu gnutls 2.12.7
  • gnu gnutls 2.12.8
  • gnu gnutls 2.12.9
  • gnu gnutls 2.12.10
  • gnu gnutls 2.12.11
  • gnu gnutls 2.12.12
  • gnu gnutls 2.12.13
  • gnu gnutls 2.12.14
  • gnu gnutls 2.12.15
  • gnu gnutls 2.12.16
  • gnu gnutls 3.0
  • gnu gnutls 3.0.0
  • gnu gnutls 3.0.1
  • gnu gnutls 3.0.2
  • gnu gnutls 3.0.3
  • gnu gnutls 3.0.4
  • gnu gnutls 3.0.5
  • gnu gnutls 3.0.6
  • gnu gnutls 3.0.7
  • gnu gnutls 3.0.8
  • gnu gnutls 3.0.9
  • gnu gnutls 3.0.10
  • gnu gnutls 3.0.11
  • gnu gnutls 3.0.12
  • gnu gnutls 3.0.13
  • gnu gnutls 3.0.14

Ease of attack

CVE-2012-1573:

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

False positives

None known

False negatives

None known

Corrective action

Upgrade to the latest non-affected version of the software.

Apply the appropriate vendor supplied patches.

Contributors

  • Talos research team.
  • This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology.
  • For more information see nvd.

Additional References