CVE-2012-1573

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

High exploitation probability; assess promptly

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GnuTLS是比利时Nikos Mavrogiannopoulos和瑞典Simon Josefsson软件开发者共同研发的一个免费的用于实现SSL、TLS和DTLS协议的安全通信库。 GnuTLS中存在基于堆的内存破坏漏洞。攻击者可利用该漏洞在受影响应用程序上下文中执行任意代码，攻击失败将导致拒绝服务。

CVE-2012-1573 affects n/a n/a. High exploitation probability; assess promptly. GnuTLS是比利时Nikos Mavrogiannopoulos和瑞典Simon Josefsson软件开发者共同研发的一个免费的用于实现SSL、TLS和DTLS协议的安全通信库。 GnuTLS中存在基于堆的内存破坏漏洞。攻击者可利用该漏洞在受影响应用程序上下文中执行任意代码，攻击失败将导致拒绝服务。 CVE-2012-1573 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2012-1573

I. Basic Information for CVE-2012-1573

Affected Products

II. Public POCs for CVE-2012-1573

III. Intelligence Information for CVE-2012-1573

Vendor Advisories for CVE-2012-1573 (14)

• https://bugzilla.redhat.com/show_bug.cgi?id=805432 x_refsource_CONFIRM
• http://secunia.com/advisories/48511 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48596 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/48488 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/52667 vdb-entry x_refsource_BID
• 🔗 http://osvdb.org/80259 vdb-entry x_refsource_OSVDB
• http://secunia.com/advisories/48712 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/57260 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1026828 vdb-entry x_refsource_SECTRACK
• http://www.ubuntu.com/usn/USN-1418-1 vendor-advisory x_refsource_UBUNTU
• http://rhn.redhat.com/errata/RHSA-2012-0488.html vendor-advisory x_refsource_REDHAT
• http://rhn.redhat.com/errata/RHSA-2012-0531.html vendor-advisory x_refsource_REDHAT
• http://rhn.redhat.com/errata/RHSA-2012-0429.html vendor-advisory x_refsource_REDHAT
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:040 vendor-advisory x_refsource_MANDRIVA

Mailing List Discussions for CVE-2012-1573 (8)

• http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html vendor-advisory x_refsource_FEDORA
• 🔗 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html vendor-advisory x_refsource_FEDORA
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html vendor-advisory x_refsource_SUSE
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912 mailing-list x_refsource_MLIST
• http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910 mailing-list x_refsource_MLIST
• 🔗 http://www.openwall.com/lists/oss-security/2012/03/21/4 mailing-list x_refsource_MLIST
• http://www.openwall.com/lists/oss-security/2012/03/21/5 mailing-list x_refsource_MLIST
• http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html mailing-list x_refsource_BUGTRAQ

Security Blog Posts for CVE-2012-1573 (1)

• http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/ x_refsource_MISC

Other References for CVE-2012-1573 (2)

• http://www.gnu.org/software/gnutls/security.html x_refsource_CONFIRM
• http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185 x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2012-1573

Same Patch Batch · n/a · 2012-03-26 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2012-1573