製品・ソフトウェアに関する情報

JVN脆弱性詳細

GnuTLS におけるサービス運用妨害 (ヒープメモリ破損およびアプリケーションクラッシュ) の脆弱性

タイトル	GnuTLS におけるサービス運用妨害 (ヒープメモリ破損およびアプリケーションクラッシュ) の脆弱性
概要	GnuTLS の libgnutls 内の gnutls_cipher.c は、ブロック暗号で暗号化されたデータを適切に処理しないため、サービス運用妨害 (ヒープメモリ破損およびアプリケーションクラッシュ) 状態となる脆弱性が存在します。
想定される影響	第三者により、巧妙に細工されたレコードを介して、サービス運用妨害 (ヒープメモリ破損およびアプリケーションクラッシュ) 状態にされる可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2012年3月21日0:00
登録日	2012年3月28日14:24
最終更新日	2012年12月17日18:09

CVSS2.0 : 警告
スコア	5
ベクター	AV:N/AC:L/Au:N/C:N/I:N/A:P

影響を受けるシステム

GNU Project

GnuTLS 2.12.17 未満

GnuTLS 3.0.15 未満の 3.x

VMware

VMware ESX 3.5

VMware ESX 4.0

VMware ESX 4.1

VMware ESXi

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-1573	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1573
National Vulnerability Database (NVD)
2	CVE-2012-1573	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1573
SECURITY BLOG
3	CVE-2012-1573 Denial of Service vulnerability in gnutls	https://blogs.oracle.com/sunsecurity/entry/cve_2012_1573_denial_of

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-310	https://jvndb.jvn.jp/ja/cwe/CWE-310.html

ベンダー情報

No	名前	URL
Gmane
1	gnutls 2.12.16	http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910
2	gnutls 3.0.15	http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912
GnuTLS
3	News	http://www.gnu.org/software/gnutls/news.html
4	Security Advisories	http://www.gnu.org/software/gnutls/security.html
Red Hat Security Advisory
5	RHSA-2012:0429	http://rhn.redhat.com/errata/RHSA-2012-0429.html
Ubuntu Security Notice
6	USN-1418-1	http://www.ubuntu.com/usn/USN-1418-1
VMware Security Advisories
7	VMSA-2012-0013	http://www.vmware.com/jp/support/support-resources/advisories/VMSA-2012-0013.html

変更履歴

No	変更内容	変更日
0	[2012年03月28日] 掲載 [2012年09月05日] ベンダ情報：Ubuntu (USN-1418-1) を追加ベンダ情報：レッドハット (RHSA-2012:0429) を追加 [2012年10月23日] ベンダ情報：オラクル (CVE-2012-1573 Denial of Service vulnerability in gnutls) を追加 [2012年12月17日] 影響を受けるシステム：VMware (VMSA-2012-0013) の情報を追加ベンダ情報：VMware (VMSA-2012-0013) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2012-1573

概要	gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.
公表日	2012年3月27日4:55
登録日	2021年1月28日14:55
最終更新日	2024年11月21日10:37

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:gnu:gnutls:2.12.15:::::::*
cpe:2.3:a:gnu:gnutls:2.3.5:::::::*
cpe:2.3:a:gnu:gnutls:2.10.2:::::::*
cpe:2.3:a:gnu:gnutls:2.0.0:::::::*
cpe:2.3:a:gnu:gnutls:2.8.3:::::::*
cpe:2.3:a:gnu:gnutls:2.3.4:::::::*
cpe:2.3:a:gnu:gnutls:2.12.2:::::::*
cpe:2.3:a:gnu:gnutls:2.7.4:::::::*
cpe:2.3:a:gnu:gnutls:2.6.1:::::::*
cpe:2.3:a:gnu:gnutls:2.2.4:::::::*
cpe:2.3:a:gnu:gnutls:2.1.0:::::::*
cpe:2.3:a:gnu:gnutls:2.3.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.7:::::::*
cpe:2.3:a:gnu:gnutls:2.12.5:::::::*
cpe:2.3:a:gnu:gnutls:2.2.5:::::::*
cpe:2.3:a:gnu:gnutls:2.1.1:::::::*
cpe:2.3:a:gnu:gnutls:2.3.8:::::::*
cpe:2.3:a:gnu:gnutls:2.8.5:::::::*
cpe:2.3:a:gnu:gnutls:2.1.7:::::::*
cpe:2.3:a:gnu:gnutls:2.10.4:::::::*
cpe:2.3:a:gnu:gnutls:2.1.4:::::::*
cpe:2.3:a:gnu:gnutls:2.6.0:::::::*
cpe:2.3:a:gnu:gnutls:2.1.6:::::::*
cpe:2.3:a:gnu:gnutls:2.8.0:::::::*
cpe:2.3:a:gnu:gnutls:2.12.14:::::::*
cpe:2.3:a:gnu:gnutls:2.12.8:::::::*
cpe:2.3:a:gnu:gnutls:2.4.3:::::::*
cpe:2.3:a:gnu:gnutls:2.3.2:::::::*
cpe:2.3:a:gnu:gnutls:2.3.9:::::::*
cpe:2.3:a:gnu:gnutls:2.2.2:::::::*
cpe:2.3:a:gnu:gnutls:2.2.0:::::::*
cpe:2.3:a:gnu:gnutls:2.3.11:::::::*
cpe:2.3:a:gnu:gnutls:2.5.0:::::::*
cpe:2.3:a:gnu:gnutls:2.6.2:::::::*
cpe:2.3:a:gnu:gnutls:2.10.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.6.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.0:::::::*
cpe:2.3:a:gnu:gnutls:2.12.10:::::::*
cpe:2.3:a:gnu:gnutls:2.0.4:::::::*
cpe:2.3:a:gnu:gnutls:2.6.3:::::::*
cpe:2.3:a:gnu:gnutls:2.6.6:::::::*
cpe:2.3:a:gnu:gnutls:2.12.6:::::::*
cpe:2.3:a:gnu:gnutls:2.10.3:::::::*
cpe:2.3:a:gnu:gnutls:2.4.0:::::::*
cpe:2.3:a:gnu:gnutls:2.1.3:::::::*
cpe:2.3:a:gnu:gnutls:2.8.6:::::::*
cpe:2.3:a:gnu:gnutls:2.4.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.9:::::::*
cpe:2.3:a:gnu:gnutls:2.3.7:::::::*
cpe:2.3:a:gnu:gnutls:2.0.3:::::::*
cpe:2.3:a:gnu:gnutls:2.10.5:::::::*
cpe:2.3:a:gnu:gnutls:2.6.5:::::::*
cpe:2.3:a:gnu:gnutls:2.8.2:::::::*
cpe:2.3:a:gnu:gnutls:2.12.13:::::::*
cpe:2.3:a:gnu:gnutls:2.1.2:::::::*
cpe:2.3:a:gnu:gnutls:2.4.2:::::::*
cpe:2.3:a:gnu:gnutls:2.6.4:::::::*
cpe:2.3:a:gnu:gnutls:2.3.6:::::::*
cpe:2.3:a:gnu:gnutls:2.3.3:::::::*
cpe:2.3:a:gnu:gnutls:2.1.8:::::::*
cpe:2.3:a:gnu:gnutls:2.0.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.12:::::::*
cpe:2.3:a:gnu:gnutls:2.12.3:::::::*
cpe:2.3:a:gnu:gnutls:2.12.4:::::::*
cpe:2.3:a:gnu:gnutls::::::::		2.12.16
cpe:2.3:a:gnu:gnutls:2.2.1:::::::*
cpe:2.3:a:gnu:gnutls:2.1.5:::::::*
cpe:2.3:a:gnu:gnutls:2.8.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.11:::::::*
cpe:2.3:a:gnu:gnutls:2.12.1:::::::*
cpe:2.3:a:gnu:gnutls:2.10.0:::::::*
cpe:2.3:a:gnu:gnutls:2.3.10:::::::*
cpe:2.3:a:gnu:gnutls:2.0.2:::::::*
cpe:2.3:a:gnu:gnutls:2.3.0:::::::*
cpe:2.3:a:gnu:gnutls:2.2.3:::::::*
cpe:2.3:a:gnu:gnutls:2.8.4:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:a:gnu:gnutls:3.0.12:::::::*
cpe:2.3:a:gnu:gnutls:3.0.3:::::::*
cpe:2.3:a:gnu:gnutls:3.0.9:::::::*
cpe:2.3:a:gnu:gnutls:3.0.6:::::::*
cpe:2.3:a:gnu:gnutls:3.0.8:::::::*
cpe:2.3:a:gnu:gnutls:3.0:::::::*
cpe:2.3:a:gnu:gnutls:3.0.0:::::::*
cpe:2.3:a:gnu:gnutls:3.0.11:::::::*
cpe:2.3:a:gnu:gnutls:3.0.7:::::::*
cpe:2.3:a:gnu:gnutls:3.0.2:::::::*
cpe:2.3:a:gnu:gnutls:3.0.13:::::::*
cpe:2.3:a:gnu:gnutls:3.0.5:::::::*
cpe:2.3:a:gnu:gnutls:3.0.14:::::::*
cpe:2.3:a:gnu:gnutls:3.0.10:::::::*
cpe:2.3:a:gnu:gnutls:3.0.1:::::::*
cpe:2.3:a:gnu:gnutls:3.0.4:::::::*

関連情報、対策とツール

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html
2	http://archives.neohapsis.com/archives/bugtraq/2012-03/0099.html
3	http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910
4	http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5910
5	http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912
6	http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5912
7	http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/	Exploit
8	http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/	Exploit
9	http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=422214868061370aeeb0ac9cd0f021a5c350a57d
10	http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=422214868061370aeeb0ac9cd0f021a5c350a57d
11	http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185
12	http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commit%3Bh=b495740f2ff66550ca9395b3fda3ea32c3acb185
13	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html
14	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077071.html
15	http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html
16	http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076496.html
17	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
18	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
19	http://osvdb.org/80259
20	http://osvdb.org/80259
21	http://rhn.redhat.com/errata/RHSA-2012-0429.html
22	http://rhn.redhat.com/errata/RHSA-2012-0429.html
23	http://rhn.redhat.com/errata/RHSA-2012-0488.html
24	http://rhn.redhat.com/errata/RHSA-2012-0488.html
25	http://rhn.redhat.com/errata/RHSA-2012-0531.html
26	http://rhn.redhat.com/errata/RHSA-2012-0531.html
27	http://secunia.com/advisories/48488
28	http://secunia.com/advisories/48488
29	http://secunia.com/advisories/48511
30	http://secunia.com/advisories/48511
31	http://secunia.com/advisories/48596
32	http://secunia.com/advisories/48596
33	http://secunia.com/advisories/48712
34	http://secunia.com/advisories/48712
35	http://secunia.com/advisories/57260
36	http://secunia.com/advisories/57260
37	http://www.debian.org/security/2012/dsa-2441
38	http://www.debian.org/security/2012/dsa-2441
39	http://www.gnu.org/software/gnutls/security.html	Vendor Advisory
40	http://www.gnu.org/software/gnutls/security.html	Vendor Advisory
41	http://www.mandriva.com/security/advisories?name=MDVSA-2012:040
42	http://www.mandriva.com/security/advisories?name=MDVSA-2012:040
43	http://www.openwall.com/lists/oss-security/2012/03/21/4
44	http://www.openwall.com/lists/oss-security/2012/03/21/4
45	http://www.openwall.com/lists/oss-security/2012/03/21/5
46	http://www.openwall.com/lists/oss-security/2012/03/21/5
47	http://www.securityfocus.com/bid/52667
48	http://www.securityfocus.com/bid/52667
49	http://www.securitytracker.com/id?1026828
50	http://www.securitytracker.com/id?1026828
51	http://www.ubuntu.com/usn/USN-1418-1
52	http://www.ubuntu.com/usn/USN-1418-1
53	https://bugzilla.redhat.com/show_bug.cgi?id=805432
54	https://bugzilla.redhat.com/show_bug.cgi?id=805432

共通脆弱性一覧

構成1	以上	以下	より上	未満
cpe:2.3:a:gnu:gnutls:2.12.15:::::::*
cpe:2.3:a:gnu:gnutls:2.3.5:::::::*
cpe:2.3:a:gnu:gnutls:2.10.2:::::::*
cpe:2.3:a:gnu:gnutls:2.0.0:::::::*
cpe:2.3:a:gnu:gnutls:2.8.3:::::::*
cpe:2.3:a:gnu:gnutls:2.3.4:::::::*
cpe:2.3:a:gnu:gnutls:2.12.2:::::::*
cpe:2.3:a:gnu:gnutls:2.7.4:::::::*
cpe:2.3:a:gnu:gnutls:2.6.1:::::::*
cpe:2.3:a:gnu:gnutls:2.2.4:::::::*
cpe:2.3:a:gnu:gnutls:2.1.0:::::::*
cpe:2.3:a:gnu:gnutls:2.3.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.7:::::::*
cpe:2.3:a:gnu:gnutls:2.12.5:::::::*
cpe:2.3:a:gnu:gnutls:2.2.5:::::::*
cpe:2.3:a:gnu:gnutls:2.1.1:::::::*
cpe:2.3:a:gnu:gnutls:2.3.8:::::::*
cpe:2.3:a:gnu:gnutls:2.8.5:::::::*
cpe:2.3:a:gnu:gnutls:2.1.7:::::::*
cpe:2.3:a:gnu:gnutls:2.10.4:::::::*
cpe:2.3:a:gnu:gnutls:2.1.4:::::::*
cpe:2.3:a:gnu:gnutls:2.6.0:::::::*
cpe:2.3:a:gnu:gnutls:2.1.6:::::::*
cpe:2.3:a:gnu:gnutls:2.8.0:::::::*
cpe:2.3:a:gnu:gnutls:2.12.14:::::::*
cpe:2.3:a:gnu:gnutls:2.12.8:::::::*
cpe:2.3:a:gnu:gnutls:2.4.3:::::::*
cpe:2.3:a:gnu:gnutls:2.3.2:::::::*
cpe:2.3:a:gnu:gnutls:2.3.9:::::::*
cpe:2.3:a:gnu:gnutls:2.2.2:::::::*
cpe:2.3:a:gnu:gnutls:2.2.0:::::::*
cpe:2.3:a:gnu:gnutls:2.3.11:::::::*
cpe:2.3:a:gnu:gnutls:2.5.0:::::::*
cpe:2.3:a:gnu:gnutls:2.6.2:::::::*
cpe:2.3:a:gnu:gnutls:2.10.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.6.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.0:::::::*
cpe:2.3:a:gnu:gnutls:2.12.10:::::::*
cpe:2.3:a:gnu:gnutls:2.0.4:::::::*
cpe:2.3:a:gnu:gnutls:2.6.3:::::::*
cpe:2.3:a:gnu:gnutls:2.6.6:::::::*
cpe:2.3:a:gnu:gnutls:2.12.6:::::::*
cpe:2.3:a:gnu:gnutls:2.10.3:::::::*
cpe:2.3:a:gnu:gnutls:2.4.0:::::::*
cpe:2.3:a:gnu:gnutls:2.1.3:::::::*
cpe:2.3:a:gnu:gnutls:2.8.6:::::::*
cpe:2.3:a:gnu:gnutls:2.4.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.9:::::::*
cpe:2.3:a:gnu:gnutls:2.3.7:::::::*
cpe:2.3:a:gnu:gnutls:2.0.3:::::::*
cpe:2.3:a:gnu:gnutls:2.10.5:::::::*
cpe:2.3:a:gnu:gnutls:2.6.5:::::::*
cpe:2.3:a:gnu:gnutls:2.8.2:::::::*
cpe:2.3:a:gnu:gnutls:2.12.13:::::::*
cpe:2.3:a:gnu:gnutls:2.1.2:::::::*
cpe:2.3:a:gnu:gnutls:2.4.2:::::::*
cpe:2.3:a:gnu:gnutls:2.6.4:::::::*
cpe:2.3:a:gnu:gnutls:2.3.6:::::::*
cpe:2.3:a:gnu:gnutls:2.3.3:::::::*
cpe:2.3:a:gnu:gnutls:2.1.8:::::::*
cpe:2.3:a:gnu:gnutls:2.0.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.12:::::::*
cpe:2.3:a:gnu:gnutls:2.12.3:::::::*
cpe:2.3:a:gnu:gnutls:2.12.4:::::::*
cpe:2.3:a:gnu:gnutls::::::::		2.12.16
cpe:2.3:a:gnu:gnutls:2.2.1:::::::*
cpe:2.3:a:gnu:gnutls:2.1.5:::::::*
cpe:2.3:a:gnu:gnutls:2.8.1:::::::*
cpe:2.3:a:gnu:gnutls:2.12.11:::::::*
cpe:2.3:a:gnu:gnutls:2.12.1:::::::*
cpe:2.3:a:gnu:gnutls:2.10.0:::::::*
cpe:2.3:a:gnu:gnutls:2.3.10:::::::*
cpe:2.3:a:gnu:gnutls:2.0.2:::::::*
cpe:2.3:a:gnu:gnutls:2.3.0:::::::*
cpe:2.3:a:gnu:gnutls:2.2.3:::::::*
cpe:2.3:a:gnu:gnutls:2.8.4:::::::*

構成2	以上	以下	より上	未満
cpe:2.3:a:gnu:gnutls:3.0.12:::::::*
cpe:2.3:a:gnu:gnutls:3.0.3:::::::*
cpe:2.3:a:gnu:gnutls:3.0.9:::::::*
cpe:2.3:a:gnu:gnutls:3.0.6:::::::*
cpe:2.3:a:gnu:gnutls:3.0.8:::::::*
cpe:2.3:a:gnu:gnutls:3.0:::::::*
cpe:2.3:a:gnu:gnutls:3.0.0:::::::*
cpe:2.3:a:gnu:gnutls:3.0.11:::::::*
cpe:2.3:a:gnu:gnutls:3.0.7:::::::*
cpe:2.3:a:gnu:gnutls:3.0.2:::::::*
cpe:2.3:a:gnu:gnutls:3.0.13:::::::*
cpe:2.3:a:gnu:gnutls:3.0.5:::::::*
cpe:2.3:a:gnu:gnutls:3.0.14:::::::*
cpe:2.3:a:gnu:gnutls:3.0.10:::::::*
cpe:2.3:a:gnu:gnutls:3.0.1:::::::*
cpe:2.3:a:gnu:gnutls:3.0.4:::::::*