The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of-bounds read) by clearing the high bit of the byte after invalid utf-8 encoded data.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The append_utf8_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to     cause a denial of service (out-of-bounds read) by clearing the high bit of the byte after invalid utf-8     encoded data. (CVE-2016-4356)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the libksba package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The append_utf8_value function in the DN decoder (dn.c)     in Libksba before 1.3.3 allows remote attackers to     cause a denial of service (out-of-bounds read) by     clearing the high bit of the byte after invalid utf-8     encoded data.(CVE-2016-4356)

  - Off-by-one error in the append_utf8_value function in     the DN decoder (dn.c) in Libksba before 1.3.4 allows     remote attackers to cause a denial of service     (out-of-bounds read) via invalid utf-8 encoded data.
    NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-4356.(CVE-2016-4574)

  - Libksba before 1.3.4 allows remote attackers to cause a     denial of service (out-of-bounds read and crash) via     unspecified vectors, related to the 'returned length of     the object from _ksba_ber_parse_tl.'(CVE-2016-4579)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libksba fixes the following issues :

Security issue fixed :

  - boo#979261: OOB read access bugs remote DoS

  - CVE-2016-4574: off-by-one OOB read access (incomplete     fix for CVE-2016-4356)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2982-1 advisory.

    Hanno Bck discovered that Libksba incorrectly handled decoding certain BER data. An attacker could use     this issue to cause Libksba to crash, resulting in a denial of service. This issue only applied to Ubuntu     12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-4353)

    Hanno Bck discovered that Libksba incorrectly handled decoding certain BER data. An attacker could use     this issue to cause Libksba to crash, resulting in a denial of service, or possibly execute arbitrary     code. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-4354, CVE-2016-4355)

    Hanno Bck discovered that Libksba incorrectly handled incorrect utf-8 strings when decoding certain DN     data. An attacker could use this issue to cause Libksba to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.
    (CVE-2016-4356)

    Pascal Cuoq discovered that Libksba incorrectly handled incorrect utf-8 strings when decoding certain DN     data. An attacker could use this issue to cause Libksba to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2016-4574)

    Pascal Cuoq discovered that Libksba incorrectly handled decoding certain data. An attacker could use this     issue to cause Libksba to crash, resulting in a denial of service. (CVE-2016-4579)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Martin Prpic, Red Hat Product Security Team, reports :

Denial of Service due to stack overflow in src/ber-decoder.c.

Integer overflow in the BER decoder src/ber-decoder.c.

Integer overflow in the DN decoder src/dn.c.

ID	Name	Product	Family	Severity
219586	Linux Distros Unpatched Vulnerability : CVE-2016-4356	Nessus	Misc.	high
146660	EulerOS 2.0 SP2 : libksba (EulerOS-SA-2021-1317)	Nessus	Huawei Local Security Checks	high
146120	EulerOS 2.0 SP5 : libksba (EulerOS-SA-2021-1203)	Nessus	Huawei Local Security Checks	high
145213	EulerOS 2.0 SP3 : libksba (EulerOS-SA-2021-1086)	Nessus	Huawei Local Security Checks	high
91289	openSUSE Security Update : libksba (openSUSE-2016-624)	Nessus	SuSE Local Security Checks	high
91220	Ubuntu 14.04 LTS / 16.04 LTS : Libksba vulnerabilities (USN-2982-1)	Nessus	Ubuntu Local Security Checks	high
90848	FreeBSD : libksba -- local denial of service vulnerabilities (a1134048-10c6-11e6-94fa-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2016-4356

high

Tenable Plugins

high

high

high

high

high

high

high