The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2294-1 advisory.

    It was discovered that Libtasn1 incorrectly handled certain ASN.1 data structures. An attacker could     exploit this with specially crafted ASN.1 data and cause applications using Libtasn1 to crash, resulting     in a denial of service. (CVE-2014-3467)

    It was discovered that Libtasn1 incorrectly handled negative bit lengths. An attacker could exploit this     with specially crafted ASN.1 data and cause applications using Libtasn1 to crash, resulting in a denial of     service, or possibly execute arbitrary code. (CVE-2014-3468)

    It was discovered that Libtasn1 incorrectly handled certain ASN.1 data. An attacker could exploit this     with specially crafted ASN.1 data and cause applications using Libtasn1 to crash, resulting in a denial of     service. (CVE-2014-3469)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0596 advisory.

    The libtasn1 library provides Abstract Syntax Notation One (ASN.1) parsing     and structures management, and Distinguished Encoding Rules (DER) encoding     and decoding functions.

    It was discovered that the asn1_get_bit_der() function of the libtasn1     library incorrectly reported the length of ASN.1-encoded data. Specially     crafted ASN.1 input could cause an application using libtasn1 to perform     an out-of-bounds access operation, causing the application to crash or,     possibly, execute arbitrary code. (CVE-2014-3468)

    Multiple incorrect buffer boundary check issues were discovered in     libtasn1. Specially crafted ASN.1 input could cause an application using     libtasn1 to crash. (CVE-2014-3467)

    Multiple NULL pointer dereference flaws were found in libtasn1's     asn1_read_value() function. Specially crafted ASN.1 input could cause an     application using libtasn1 to crash, if the application used the     aforementioned function in a certain way. (CVE-2014-3469)

    Red Hat would like to thank GnuTLS upstream for reporting these issues.

    All libtasn1 users are advised to upgrade to these updated packages, which     correct these issues. For the update to take effect, all applications     linked to the libtasn1 library must be restarted.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated gnutls packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The GnuTLS library provides support for cryptographic algorithms and for protocols such as Transport Layer Security (TLS). The gnutls packages also include the libtasn1 library, which provides Abstract Syntax Notation One (ASN.1) parsing and structures management, and Distinguished Encoding Rules (DER) encoding and decoding functions.

A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code. (CVE-2014-3466)

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data.
Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.
(CVE-2014-3468)

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467)

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469)

Red Hat would like to thank GnuTLS upstream for reporting these issues. Upstream acknowledges Joonas Kuorilehto of Codenomicon as the original reporter of CVE-2014-3466.

Users of GnuTLS are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the GnuTLS or libtasn1 library must be restarted.

Updated libtasn1 packages that fix three security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libtasn1 library provides Abstract Syntax Notation One (ASN.1) parsing and structures management, and Distinguished Encoding Rules (DER) encoding and decoding functions.

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data.
Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.
(CVE-2014-3468)

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467)

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469)

Red Hat would like to thank GnuTLS upstream for reporting these issues.

All libtasn1 users are advised to upgrade to these updated packages, which correct these issues. For the update to take effect, all applications linked to the libtasn1 library must be restarted.

new upstream release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 (Abstract Syntax Notation One) structures. An attacker could use those to cause a denial of service via out-of-bounds access or NULL pointer dereference.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New libtasn1 packages are available for Slackware 14.0, 14.1, and
-current to fix security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0596 advisory.

    [2.3-6]
    - added check for null pointer (#1102336)

    [2.3-5]
    - fix various DER decoding issues (#1102336)

    [2.3-4]
    - fix CVE-2012-1569 - missing length check when decoding DER lengths (#804920)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data.
Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.
(CVE-2014-3468)

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467)

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469)

For the update to take effect, all applications linked to the libtasn1 library must be restarted.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0687 advisory.

    The libtasn1 library provides Abstract Syntax Notation One (ASN.1) parsing     and structures management, and Distinguished Encoding Rules (DER) encoding     and decoding functions.

    It was discovered that the asn1_get_bit_der() function of the libtasn1     library incorrectly reported the length of ASN.1-encoded data. Specially     crafted ASN.1 input could cause an application using libtasn1 to perform     an out-of-bounds access operation, causing the application to crash or,     possibly, execute arbitrary code. (CVE-2014-3468)

    Multiple incorrect buffer boundary check issues were discovered in     libtasn1. Specially crafted ASN.1 input could cause an application using     libtasn1 to crash. (CVE-2014-3467)

    Multiple NULL pointer dereference flaws were found in libtasn1's     asn1_read_value() function. Specially crafted ASN.1 input could cause an     application using libtasn1 to crash, if the application used the     aforementioned function in a certain way. (CVE-2014-3469)

    Red Hat would like to thank GnuTLS upstream for reporting these issues.

    All libtasn1 users are advised to upgrade to these updated packages, which     correct these issues. For the update to take effect, all applications     linked to the libtasn1 library must be restarted.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201408-09 (GNU Libtasn1: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU Libtasn1. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly cause a Denial of Service       condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-0594 advisory.

    [1.4.1-16]
    - added missing check for null pointer (#1102355)

    [1.4.1-15]
    - fix session ID length check and null pointer dereference (#1102355)
    - fix minitasn1 issues (#1102355)
    - Renamed gnutls-1.4.1-cve-2014-5138.patch to cve-2009-5138.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake. A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or, possibly, execute arbitrary code. (CVE-2014-3466)

It was discovered that the asn1_get_bit_der() function of the libtasn1 library incorrectly reported the length of ASN.1-encoded data.
Specially crafted ASN.1 input could cause an application using libtasn1 to perform an out-of-bounds access operation, causing the application to crash or, possibly, execute arbitrary code.
(CVE-2014-3468)

Multiple incorrect buffer boundary check issues were discovered in libtasn1. Specially crafted ASN.1 input could cause an application using libtasn1 to crash. (CVE-2014-3467)

Multiple NULL pointer dereference flaws were found in libtasn1's asn1_read_value() function. Specially crafted ASN.1 input could cause an application using libtasn1 to crash, if the application used the aforementioned function in a certain way. (CVE-2014-3469)

For the update to take effect, all applications linked to the GnuTLS or libtasn1 library must be restarted.

GnuTLS has been patched to ensure proper parsing of session ids during the TLS/SSL handshake. Additionally, three issues inherited from libtasn1 have been fixed.

Further information is available at http://www.gnutls.org/security.html#GNUTLS-SA-2014-3

These security issues have been fixed :

  - Possible memory corruption during connect.
    (CVE-2014-3466)

  - Multiple boundary check issues could allow DoS.
    (CVE-2014-3467)

  - asn1_get_bit_der() can return negative bit length.
    (CVE-2014-3468)

  - Possible DoS by NULL pointer dereference (CVE-2014-3469)

Several vulnerabilities were discovered in libtasn1-3, a library that manages ASN1 (Abstract Syntax Notation One) structures. An attacker could use those to cause a denial-of-service via out-of-bounds access or NULL pointer dereference.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
76704	Ubuntu 14.04 LTS : Libtasn1 vulnerabilities (USN-2294-1)	Nessus	Ubuntu Local Security Checks	2014/7/23	2024/8/27	critical
74303	RHEL 6 : libtasn1 (RHSA-2014:0596)	Nessus	Red Hat Local Security Checks	2014/6/4	2024/11/4	critical
74309	CentOS 5 : gnutls (CESA-2014:0594)	Nessus	CentOS Local Security Checks	2014/6/5	2021/1/4	medium
74311	CentOS 6 : libtasn1 (CESA-2014:0596)	Nessus	CentOS Local Security Checks	2014/6/5	2021/1/4	medium
74317	Fedora 20 : libtasn1-3.6-1.fc20 (2014-6895)	Nessus	Fedora Local Security Checks	2014/6/5	2021/1/11	medium
74407	Fedora 19 : libtasn1-3.6-1.fc19 (2014-6919)	Nessus	Fedora Local Security Checks	2014/6/10	2021/1/11	medium
82222	Debian DLA-77-1 : libtasn1-3 security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
74330	Slackware 14.0 / 14.1 / current : libtasn1 (SSA:2014-156-02)	Nessus	Slackware Local Security Checks	2014/6/6	2021/1/14	medium
74298	Oracle Linux 6 : libtasn1 (ELSA-2014-0596)	Nessus	Oracle Linux Local Security Checks	2014/6/4	2024/10/23	critical
74307	Scientific Linux Security Update : libtasn1 on SL6.x i386/x86_64 (20140603)	Nessus	Scientific Linux Local Security Checks	2014/6/4	2021/1/14	medium
76896	RHEL 7 : libtasn1 (RHSA-2014:0687)	Nessus	Red Hat Local Security Checks	2014/7/30	2025/4/15	critical
77453	GLSA-201408-09 : GNU Libtasn1: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/8/30	2021/1/6	medium
74296	Oracle Linux 5 : gnutls (ELSA-2014-0594)	Nessus	Oracle Linux Local Security Checks	2014/6/4	2024/10/22	critical
74305	Scientific Linux Security Update : gnutls on SL5.x i386/x86_64 (20140603)	Nessus	Scientific Linux Local Security Checks	2014/6/4	2021/1/14	medium
74321	SuSE 11.3 Security Update : gnutls (SAT Patch Number 9320)	Nessus	SuSE Local Security Checks	2014/6/5	2021/1/19	medium
78681	Debian DSA-3056-1 : libtasn1-3 - security update	Nessus	Debian Local Security Checks	2014/10/27	2021/1/11	medium

检测

插件搜索

critical

critical

medium

medium

medium

medium

medium

medium

critical

medium

critical

medium

critical

medium

medium

medium