Explain CVE-2012-1569
The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure.
Affected Products: n/a
References: [{'name': '57260', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57260'}, {'name': 'RHSA-2012:0427', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0427.html'}, {'name': '48578', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48578'}, {'name': 'RHSA-2012:0531', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0531.html'}, {'name': '49002', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49002'}, {'name': 'FEDORA-2012-4357', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077339.html'}, {'name': '[oss-security] 20120320 Re: CVE request: libtasn1 "asn1_get_length_der()" DER decoding issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/20/8'}, {'name': '[oss-security] 20120321 Re: CVE request: GnuTLS TLS record handling issue / MU-201202-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/21/5'}, {'name': '48488', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48488'}, {'name': 'USN-1436-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1436-1'}, {'name': 'FEDORA-2012-4342', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076865.html'}, {'name': 'FEDORA-2012-4451', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077284.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.gnu.org/software/gnutls/security.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=804920'}, {'name': 'RHSA-2012:0488', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0488.html'}, {'name': 'FEDORA-2012-4308', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076856.html'}, {'name': 'SUSE-SU-2014:0320', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html'}, {'name': '[gnutls-devel] 20120316 gnutls 3.0.16', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5932'}, {'name': '1026829', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026829'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://linux.oracle.com/errata/ELSA-2014-0596.html'}, {'name': '48596', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48596'}, {'name': '50739', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50739'}, {'name': '48397', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48397'}, {'name': '48505', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48505'}, {'tags': ['x_refsource_MISC'], 'url': 'http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/'}, {'name': '[help-libtasn1] 20120319 GNU Libtasn1 2.12 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://article.gmane.org/gmane.comp.gnu.libtasn1.general/53'}, {'name': '[help-libtasn1] 20120319 minimal fix to security issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://article.gmane.org/gmane.comp.gnu.libtasn1.general/54'}, {'name': '[oss-security] 20120320 CVE request: libtasn1 "asn1_get_length_der()" DER decoding issue', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/20/3'}, {'name': 'DSA-2440', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2440'}, {'name': 'MDVSA-2012:039', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:039'}, {'name': 'FEDORA-2012-4409', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076699.html'}, {'name': '20120320 Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html'}, {'name': 'FEDORA-2012-4417', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078207.html'}]
CVE State: PUBLISHED