GnuTLS CVE-2013-4466 'libdane/dane.c' Remote Buffer Overflow Vulnerability

Bugtraq ID:	63326
Class:	Boundary Condition Error
CVE:	CVE-2013-4466
Remote:	Yes
Local:	No
Published:	Oct 21 2013 12:00AM
Updated:	Apr 13 2015 08:36PM
Credit:	The vendor reported this issue.
Vulnerable:
Not Vulnerable:

GnuTLS CVE-2013-4466 'libdane/dane.c' Remote Buffer Overflow Vulnerability

GnuTLS is prone to a remote buffer-overflow vulnerability that affects its 'libdane' library because it fails to perform adequate boundary-checks on user-supplied data.

Attackers may leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts may result in a denial-of-service condition.

Versions prior to GnuTLS 3.1.15 and 3.2.5 are vulnerable.

GnuTLS CVE-2013-4466 'libdane/dane.c' Remote Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GnuTLS CVE-2013-4466 'libdane/dane.c' Remote Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GnuTLS CVE-2013-4466 'libdane/dane.c' Remote Buffer Overflow Vulnerability

References:

• Commit for 3.1 GnuTLS (GNU)
  
• Commit for 3.2: GnuTLS (GNU)
  
• GnuTLS Homepage (GNU)
  
• GNUTLS-SA-2013-3 Denial of service (GNU)