Executive Summary

Summary
Title GnuTLS: Denial of Service
Informations
Name GLSA-201710-15 First vendor Publication 2017-10-15
Vendor Gentoo Last vendor Modification 2017-10-15
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A null pointer dereference in GnuTLS might allow attackers to cause a Denial of Service condition.

Background

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them.

Description

A null pointer dereference while decoding a status response TLS extension with valid contents was discovered in GnuTLS.

Impact

A remote attacker could possibly cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All GnuTLS users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/gnutls-3.5.13"

Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.

References

[ 1 ] CVE-2017-7507 : https://nvd.nist.gov/vuln/detail/CVE-2017-7507

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201710-15

Original Source

Url : http://security.gentoo.org/glsa/glsa-201710-15.xml

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-476 NULL Pointer Dereference

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 278

Nessus® Vulnerability Scanner

Date Description
2018-08-17 Name : The remote PhotonOS host is missing multiple security updates.
File : PhotonOS_PHSA-2017-0038.nasl - Type : ACT_GATHER_INFO
2017-10-16 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201710-15.nasl - Type : ACT_GATHER_INFO
2017-09-11 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2017-1203.nasl - Type : ACT_GATHER_INFO
2017-09-11 Name : The remote EulerOS host is missing multiple security updates.
File : EulerOS_SA-2017-1204.nasl - Type : ACT_GATHER_INFO
2017-08-25 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2017-2292.nasl - Type : ACT_GATHER_INFO
2017-08-22 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20170801_gnutls_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2017-08-09 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2017-2292.nasl - Type : ACT_GATHER_INFO
2017-08-02 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2292.nasl - Type : ACT_GATHER_INFO
2017-07-17 Name : The remote Fedora host is missing a security update.
File : fedora_2017-7936341c80.nasl - Type : ACT_GATHER_INFO
2017-07-17 Name : The remote Fedora host is missing a security update.
File : fedora_2017-f0d48eabe6.nasl - Type : ACT_GATHER_INFO
2017-07-17 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2017-824.nasl - Type : ACT_GATHER_INFO
2017-07-12 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2017-1838-1.nasl - Type : ACT_GATHER_INFO
2017-06-19 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3884.nasl - Type : ACT_GATHER_INFO
2017-06-14 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-3318-1.nasl - Type : ACT_GATHER_INFO
2017-06-12 Name : The remote Fedora host is missing a security update.
File : fedora_2017-f646217583.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2017-10-17 13:25:15
  • Multiple Updates
2017-10-15 09:22:39
  • First insertion