Input validation error in GnuTLS - CVE-2013-2116
Published: July 3, 2013 / Updated: August 3, 2020
Vulnerability identifier: #VU33306
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-2116
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (buffer over-read and crash) via a crafted padding length.
Affected software
GnuTLS
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
gnutls (Alpine package)
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
gnutls (Alpine package)
How to mitigate CVE-2013-2116
Update to version 2.12.24.
GnuTLS - update to 2.12.24
gnutls (Alpine package) - update to 2.12.7-r3
gnutls (Alpine package) - update to 2.12.7-r3
External References
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00019.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00003.html
- http://rhn.redhat.com/errata/RHSA-2013-0883.html
- http://secunia.com/advisories/53911
- http://secunia.com/advisories/57260
- http://secunia.com/advisories/57274
- http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/6753
- http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/6754
- http://www.debian.org/security/2013/dsa-2697
- http://www.gnutls.org/security.html#GNUTLS-SA-2013-2
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:171
- http://www.securitytracker.com/id/1028603
- http://www.ubuntu.com/usn/USN-1843-1
- https://gitorious.org/gnutls/gnutls/commit/5164d5a1d57cd0372a5dd074382ca960ca18b27d