BID:10839

Gnu Transport Layer Security Library X.509 Certificate Verification Denial Of Service Vulnerability

Info

Gnu Transport Layer Security Library X.509 Certificate Verification Denial Of Service Vulnerability

Bugtraq ID:	10839
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 02 2004 12:00AM
Updated:	Aug 02 2004 12:00AM
Credit:	Discovery of this issue is credited to Patrik Hornik <[email protected]>.
Vulnerable:	GNU GnuTLS 1.0.16 GNU GnuTLS 1.0.15 GNU GnuTLS 1.0.14 GNU GnuTLS 1.0.9 GNU GnuTLS 1.0.8 GNU GnuTLS 1.0.7 GNU GnuTLS 1.0.6 GNU GnuTLS 1.0.5 GNU GnuTLS 1.0.4 GNU GnuTLS 1.0.3 GNU GnuTLS 1.0.2 GNU GnuTLS 1.0.1 GNU GnuTLS 1.0

Not Vulnerable:	GNU GnuTLS 1.0.17

Discussion

Gnu Transport Layer Security Library X.509 Certificate Verification Denial Of Service Vulnerability

Reportedly Gnu Transport Layer Security Library (GnuTLS) is affected by a X.509 certificate verification denial of service vulnerability. This issue is due to a design error that causes the application to attempt to verify invalid X.509 certificates.

This issue would allow an attacker to cause the affected application to consume CPU resources and hang while attempted verification takes place, denying service to legitimate users.

Exploit / POC

Gnu Transport Layer Security Library X.509 Certificate Verification Denial Of Service Vulnerability

No exploit is required to leverage this issue.

Solution / Fix

Gnu Transport Layer Security Library X.509 Certificate Verification Denial Of Service Vulnerability

Solution:
An upgrade has been released dealing with this issue.

GNU GnuTLS 1.0