The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.

According to the versions of the libtasn1 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap-based buffer overflow flaw was found in the way     the libtasn1 library decoded certain DER-encoded     inputs. A specially crafted DER-encoded input could     cause an application using libtasn1 to perform an     invalid read, causing the application to crash.
    (CVE-2015-3622)

  - A stack-based buffer overflow was found in the way     libtasn1 decoded certain DER encoded data. An attacker     could use this flaw to crash an application using the     libtasn1 library. (CVE-2015-2806)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libtasn1 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Libtasn1 is a library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.

The following packages have been upgraded to a later upstream version:
libtasn1 (4.10). (BZ#1360639)

Security Fix(es) :

* A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded inputs. A specially crafted DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash. (CVE-2015-3622)

* A stack-based buffer overflow was found in the way libtasn1 decoded certain DER encoded data. An attacker could use this flaw to crash an application using the libtasn1 library. (CVE-2015-2806)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

The following packages have been upgraded to a later upstream version:
libtasn1 (4.10).

Security Fix(es) :

  - A heap-based buffer overflow flaw was found in the way     the libtasn1 library decoded certain DER-encoded inputs.
    A specially crafted DER- encoded input could cause an     application using libtasn1 to perform an invalid read,     causing the application to crash. (CVE-2015-3622)

  - A stack-based buffer overflow was found in the way     libtasn1 decoded certain DER encoded data. An attacker     could use this flaw to crash an application using the     libtasn1 library. (CVE-2015-2806)

From Red Hat Security Advisory 2017:1860 :

An update for libtasn1 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Libtasn1 is a library that provides Abstract Syntax Notation One (ASN.1, as specified by the X.680 ITU-T recommendation) parsing and structures management, and Distinguished Encoding Rules (DER, as per X.690) encoding and decoding functions.

The following packages have been upgraded to a later upstream version:
libtasn1 (4.10). (BZ#1360639)

Security Fix(es) :

* A heap-based buffer overflow flaw was found in the way the libtasn1 library decoded certain DER-encoded inputs. A specially crafted DER-encoded input could cause an application using libtasn1 to perform an invalid read, causing the application to crash. (CVE-2015-3622)

* A stack-based buffer overflow was found in the way libtasn1 decoded certain DER encoded data. An attacker could use this flaw to crash an application using the libtasn1 library. (CVE-2015-2806)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

This update was imported from the SUSE:SLE-12:Update update project.

This update for libtasn1 fixes the following issues :

  - Malformed asn1 definitions could have caused a     segmentation fault in the asn1 definition parser     (bsc#961491)

  - CVE-2015-3622: Fixed invalid read in octet string     decoding (bsc#929414)

  - CVE-2016-4008: Fixed infinite loop while parsing DER     certificates (bsc#982779)

The remote host is affected by the vulnerability described in GLSA-201509-04 (libtasn1: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libtasn1. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

gnutls was updated to fix several security vulnerabilities.

  - fix double free in certificate DN decoding     (GNUTLS-SA-2015-3)(bsc#941794,CVE-2015-6251)

  - fix invalid read in octet string in bundled libtasn1     (bsc#929414,CVE-2015-3622)

  - fix ServerKeyExchange signature issue     (GNUTLS-SA-2015-2)(bsc#929690)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix for CVE-2015-3622 in bundled libtasn1 (bsc#929414)

  - invalid read in octet string

  - added gnutls-CVE-2015-3622.patch

  - fix for GNUTLS-SA-2015-2 (bsc#929690)

  - ServerKeyExchange signature issue

  - added gnutls-GNUTLS-SA-2015-2.patch

Update to 4.5 (#1217282)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Hanno Bock discovered that Libtasn1 incorrectly handled certain ASN.1 data. A remote attacker could possibly exploit this with specially crafted ASN.1 data and cause applications using Libtasn1 to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libtasn1 packages fix security vulnerability :

A malformed certificate input could cause a heap overflow read in the DER decoding functions of Libtasn1. The heap overflow happens in the function _asn1_extract_der_octet() (CVE-2015-3622).

Hanno Boeck discovered a heap-based buffer overflow flaw in the way Libtasn1, a library to manage ASN.1 structures, decoded certain DER-encoded input. A specially crafted DER-encoded input could cause an application using the Libtasn1 library to crash, or potentially to execute arbitrary code.

ID	Name	Product	Family	Severity
103010	EulerOS 2.0 SP2 : libtasn1 (EulerOS-SA-2017-1172)	Nessus	Huawei Local Security Checks	critical
103009	EulerOS 2.0 SP1 : libtasn1 (EulerOS-SA-2017-1171)	Nessus	Huawei Local Security Checks	critical
102739	CentOS 7 : libtasn1 (CESA-2017:1860)	Nessus	CentOS Local Security Checks	critical
102647	Scientific Linux Security Update : libtasn1 on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	critical
102285	Oracle Linux 7 : libtasn1 (ELSA-2017-1860)	Nessus	Oracle Linux Local Security Checks	critical
102146	RHEL 7 : libtasn1 (RHSA-2017:1860)	Nessus	Red Hat Local Security Checks	critical
93152	SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2016:1601-1)	Nessus	SuSE Local Security Checks	medium
93151	SUSE SLES11 Security Update : libtasn1 (SUSE-SU-2016:1600-1)	Nessus	SuSE Local Security Checks	medium
91868	openSUSE Security Update : libtasn1 (openSUSE-2016-773)	Nessus	SuSE Local Security Checks	medium
91619	openSUSE Security Update : libtasn1 (openSUSE-2016-716)	Nessus	SuSE Local Security Checks	medium
86135	GLSA-201509-04 : libtasn1: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
85901	SUSE SLED12 / SLES12 Security Update : gnutls (SUSE-SU-2015:1518-1)	Nessus	SuSE Local Security Checks	medium
85371	openSUSE Security Update : gnutls (openSUSE-2015-542)	Nessus	SuSE Local Security Checks	medium
83550	Fedora 21 : libtasn1-4.5-1.fc21 (2015-7288)	Nessus	Fedora Local Security Checks	medium
83344	Ubuntu 14.04 LTS : Libtasn1 vulnerability (USN-2604-1)	Nessus	Ubuntu Local Security Checks	medium
83329	Mandriva Linux Security Advisory : libtasn1 (MDVSA-2015:232)	Nessus	Mandriva Local Security Checks	medium
83308	Debian DSA-3256-1 : libtasn1-6 - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-3622

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium