GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU     usage will reach 100% when running asn1Paser against the POC due to an issue in
    _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be     exploitable via parsing a crafted file. (CVE-2018-1000654)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3797-1 advisory.

  - Two errors in the asn1_find_node() function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can     be exploited to cause a stacked-based buffer overflow by tricking a user into processing a specially     crafted assignments file via the e.g. asn1Coding utility. (CVE-2017-6891)

  - GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU     usage will reach 100% when running asn1Paser against the POC due to an issue in
    _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be     exploitable via parsing a crafted file. (CVE-2018-1000654)

  - GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects     asn1_encode_simple_der. (CVE-2021-46848)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5352-1 advisory.

    It was discovered that Libtasn1 incorrectly handled certain files. An attacker could possibly use this     issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libtasn1 package has been released.

This update for libtasn1 fixes the following issues :

Security issue fixed :

CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libtasn1 fixes the following issues :

Security issues fixed :

  - CVE-2018-1000654: Fixed a denial of service in the asn1     parser (bsc#1105435).

  - CVE-2017-6891: Fixed a stack overflow in     asn1_find_node() (bsc#1040621).

This update was imported from the SUSE:SLE-12-SP3:Update update project.

This update for libtasn1 fixes the following issues :

Security issue fixed :

  - CVE-2018-1000654: Fixed a denial of service in the asn1     parser (bsc#1105435).

This update was imported from the SUSE:SLE-15:Update update project.

This update for libtasn1 fixes the following issues :

Security issues fixed :

CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435).

CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
221414	Linux Distros Unpatched Vulnerability : CVE-2018-1000654	Nessus	Misc.	medium
166694	SUSE SLES12 Security Update : libtasn1 (SUSE-SU-2022:3797-1)	Nessus	SuSE Local Security Checks	critical
159328	Ubuntu 16.04 ESM : Libtasn1 vulnerability (USN-5352-1)	Nessus	Ubuntu Local Security Checks	medium
136554	Photon OS 1.0: Libtasn1 PHSA-2020-1.0-0292	Nessus	PhotonOS Local Security Checks	medium
136329	Photon OS 2.0: Libtasn1 PHSA-2020-2.0-0236	Nessus	PhotonOS Local Security Checks	medium
135777	Photon OS 3.0: Libtasn1 PHSA-2020-3.0-0081	Nessus	PhotonOS Local Security Checks	medium
126495	SUSE SLED15 / SLES15 Security Update : libtasn1 (SUSE-SU-2019:1372-2)	Nessus	SuSE Local Security Checks	medium
125757	openSUSE Security Update : libtasn1 (openSUSE-2019-1510)	Nessus	SuSE Local Security Checks	high
125696	openSUSE Security Update : libtasn1 (openSUSE-2019-1498)	Nessus	SuSE Local Security Checks	medium
125592	SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2019:1379-1)	Nessus	SuSE Local Security Checks	high
125541	SUSE SLED15 / SLES15 Security Update : libtasn1 (SUSE-SU-2019:1372-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-1000654

medium

Tenable Plugins

medium

critical

medium

medium

medium

medium

medium

high

medium

high

medium