Skip to Content.
Sympa Menu

sm-security - [SM-Security] GNUTLS-SA-2005-1 : Denial of service

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <thomas.houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] GNUTLS-SA-2005-1 : Denial of service
  • Date: Mon, 09 May 2005 19:49:00 +0200

gnutls was updated to 1.0.25 and 1.2.3 in all grimoires.

>From Gentoo Linux Security Advisory (GLSA 200505-04), all details on
http://www.gnu.org/software/gnutls/security.html (GNUTLS-SA-2005-1) :

Synopsis
========

The GnuTLS library is vulnerable to Denial of Service attacks.

Background
==========

GnuTLS is a free TLS 1.0 and SSL 3.0 implementation for the GNU
project.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/gnutls < 1.2.3 >= 1.2.3
*>= 1.0.25

Description
===========

A vulnerability has been discovered in the record packet parsing in the
GnuTLS library. Additionally, a flaw was also found in the RSA key
export functionality.

Impact
======

A remote attacker could exploit this vulnerability and cause a Denial
of Service to any application that utilizes the GnuTLS library.

Workaround
==========

There is no known workaround at this time.

--
Thomas Houssin

Security Team Lead : Source Mage GNU/Linux http://www.sourcemage.org
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] GNUTLS-SA-2005-1 : Denial of service, Thomas Houssin, 05/09/2005

Archive powered by MHonArc 2.6.24.

Top of Page