NVD

Id
1884  
Name
CVE-2008-1948  
Description
The _gnutls_server_name_recv_params function in lib/ext_server_name.c in libgnutls in gnutls-serv in GnuTLS before 2.2.4 does not properly calculate the number of Server Names in a TLS 1.0 Client Hello message during extension handling, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a zero value for the length of Server Names, which leads to a buffer overflow in session resumption data in the pack_security_parameters function, aka GNUTLS-SA-2008-1-1.  
Reject
 
CVSS Version
2  
CVSS Score
10  
Severity
High  
CVSS Base Score
10  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-05-21  
Modified Date
2011-03-07  
Seq
2008-1948  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
12193 1884 CVE-2008-1948 http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commitdiff;h=bc8102405fda11ea00ca3b42acc4f4bce9d6e97b  View
12194 1884 CVE-2008-1948 [gnutls-devel] 20080519 GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]  View
12195 1884 CVE-2008-1948 [gnutls-devel] 20080519 Re: GnuTLS 2.2.4 - Security release [GNUTLS-SA-2008-1]  View
12196 1884 CVE-2008-1948 [gnutls-devel] 20080519 GnuTLS 2.2.5 - Brown paper bag release  View
12197 1884 CVE-2008-1948 SUSE-SA:2008:046  View
12198 1884 CVE-2008-1948 oval:org.mitre.oval:def:10935  View
12199 1884 CVE-2008-1948 GLSA-200805-20  View
12200 1884 CVE-2008-1948 3902  View
12201 1884 CVE-2008-1948 http://sourceforge.net/project/shownotes.php?release_id=600646&group_id=21558  View
12202 1884 CVE-2008-1948 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0174  View
12203 1884 CVE-2008-1948 http://www.cert.fi/haavoittuvuudet/advisory-gnutls.html  View
12204 1884 CVE-2008-1948 DSA-1581  View
12205 1884 CVE-2008-1948 VU#111034  View
12206 1884 CVE-2008-1948 MDVSA-2008:106  View
12207 1884 CVE-2008-1948 [oss-security] 20080520 Re: CVE ID request: GNUTLS  View
12208 1884 CVE-2008-1948 [oss-security] 20080520 Re: CVE ID request: GNUTLS  View
12209 1884 CVE-2008-1948 [oss-security] 20080520 Re: CVE ID request: GNUTLS  View
12210 1884 CVE-2008-1948 RHSA-2008:0489  View
12211 1884 CVE-2008-1948 RHSA-2008:0492  View
12212 1884 CVE-2008-1948 20080520 Vulnerability Advisory on GnuTLS  View
12213 1884 CVE-2008-1948 20080522 rPSA-2008-0174-1 gnutls  View
12214 1884 CVE-2008-1948 29292  View
12215 1884 CVE-2008-1948 1020057  View
12216 1884 CVE-2008-1948 USN-613-1  View
12217 1884 CVE-2008-1948 ADV-2008-1582  View
12218 1884 CVE-2008-1948 ADV-2008-1583  View
12219 1884 CVE-2008-1948 gnutls-gnutlsservernamerecvparams-bo(42532)  View
12220 1884 CVE-2008-1948 https://issues.rpath.com/browse/RPL-2552  View
12221 1884 CVE-2008-1948 FEDORA-2008-4183  View
12222 1884 CVE-2008-1948 FEDORA-2008-4259  View
12223 1884 CVE-2008-1948 FEDORA-2008-4274  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46064 JVNDB-2008-001374 GnuTLS の _gnutls_server_name_recv_params 関数におけるバッファオーバーフローの脆弱性 GnuTLS gnutls-serv の _gnutls_server_name_recv_params 関数には、拡張処理中における TLS 1.0 の Client Hello メッセージ内の Server Names の処理に問題があり、バッファオーバーフローが発生する脆弱性が存在します。 CVE-2008-1948 32061 CVE-2008-1948 1884 10 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001374.html 2008-05-19 2008-08-08 View