CVE-2006-0645

Description

Tiny ASN.1 Library (libtasn1) before 0.2.18, as used by (1) GnuTLS 1.2.x before 1.2.10 and 1.3.x before 1.3.4, and (2) GNU Shishi, allows attackers to crash the DER decoder and possibly execute arbitrary code via "out-of-bounds access" caused by invalid input, as demonstrated by the ProtoVer SSL test suite.

7.5

CVSS

Severity: High

CVSS 2.0 •

EPSS 4.39% Top 15%

Vendor Advisory trustix.org Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory gentoo.org Vendor Advisory ubuntu.com

Affected: n/a n/a

References

Link	Tags
http://www.trustix.org/errata/2006/0008	vendor advisory
http://secunia.com/advisories/18815	third party advisory
http://securityreason.com/securityalert/446	third party advisory
http://www.redhat.com/archives/fedora-announce-list/2006-February/msg00043.html	vendor advisory
http://secunia.com/advisories/19092	third party advisory
http://securitytracker.com/id?1015612	vdb entry
http://www.osvdb.org/23054	vdb entry
http://secunia.com/advisories/18794	third party advisory
http://secunia.com/advisories/18918	third party advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:039	vendor advisory
http://secunia.com/advisories/18830	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10540	vdb entry signature
http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001059.html	mailing list
http://rhn.redhat.com/errata/RHSA-2006-0207.html	vendor advisory
http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001058.html	mailing list
http://www.debian.org/security/2006/dsa-986	vendor advisory
http://www.debian.org/security/2006/dsa-985	vendor advisory
http://www.vupen.com/english/advisories/2006/0496	vdb entry
http://josefsson.org/cgi-bin/viewcvs.cgi/libtasn1/NEWS?root=gnupg-mirror&view=markup
http://www.gentoo.org/security/en/glsa/glsa-200602-08.xml	vendor advisory
http://www.gleg.net/protover_ssl.shtml
https://exchange.xforce.ibmcloud.com/vulnerabilities/24606	vdb entry
http://lists.gnupg.org/pipermail/gnutls-dev/2006-February/001060.html	mailing list
http://www.securityfocus.com/bid/16568	vdb entry
http://secunia.com/advisories/18832	third party advisory
http://josefsson.org/cgi-bin/viewcvs.cgi/gnutls/tests/certder.c?view=markup
https://usn.ubuntu.com/251-1/	vendor advisory
http://secunia.com/advisories/19080	third party advisory
http://josefsson.org/gnutls/releases/libtasn1/libtasn1-0.2.18-from-0.2.17.patch
http://www.securityfocus.com/archive/1/424538/100/0/threaded	mailing list
http://secunia.com/advisories/18898	third party advisory

Frequently Asked Questions

What is the severity of CVE-2006-0645?: CVE-2006-0645 has been scored as a high severity vulnerability.
How to fix CVE-2006-0645?: To fix CVE-2006-0645, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-0645 being actively exploited in the wild?: It is possible that CVE-2006-0645 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.