Bug 1025637 (CVE-2013-4487)

Summary: CVE-2013-4487 gnutls: dane_query_tlsa() CVE-2013-4466 fix off-by-one
Product: [Other] Security Response Reporter: Ratul Gupta <ratulg>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: erik-fedora, jkurik, jorton, ktietz, rjones, seceng-idm-qe-list, tmraz
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20131029,reported=20131101,source=internet,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P,rhel-5/gnutls=notaffected,rhel-6/gnutls=notaffected,rhel-7/gnutls=notaffected,rhel-6/mingw32-gnutls=notaffected,fedora-all/gnutls=affected,fedora-all/mingw-gnutls=notaffected,epel-5/mingw32-gnutls=notaffected,cwe=CWE-193[auto]
Fixed In Version: gnutls 3.1.16, gnutls 3.2.6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-24 15:46:41 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 1022925, 1025638    
Bug Blocks: 1025639    

Description Ratul Gupta 2013-11-01 03:02:42 EDT
GnuTLS upstream recently fixed a bug, which seems to have emerged due to the fix implemented in CVE-2013-4466.

Upstream recommends to update to GnuTLS 3.1.16 and 3.2.6.


Comment 1 Ratul Gupta 2013-11-01 03:04:06 EDT
Created gnutls tracking bugs for this issue:

Affects: fedora-all [bug 1025638]
Comment 2 Tomas Hoger 2013-11-05 16:10:27 EST
This CVE is for an incorrect fix for CVE-2013-4466 (see bug 1022913).  It contained an off-by-one error, causing it to possibly write 5 entries to 4 slot arrays in dane_query_st / dane_query_t.  Problem is already mentioned in bug 1022913 comment 7.


This issue was discovered by Tomas Mraz of Red Hat.
Comment 3 Tomas Hoger 2013-11-05 16:11:46 EST

Not vulnerable. This issue did not affect the versions of gnutls as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for DANE protocol.
Comment 4 Fedora Update System 2013-11-10 03:10:05 EST
gnutls-3.1.16-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2013-11-17 21:56:19 EST
gnutls-3.1.16-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.