CVE-2012-1569

Name of the Vulnerable Software and Affected Versions GNU Libtasn1 versions prior to 2.12 GnuTLS versions prior to 3.0.16

Description The issue arises from the improper handling of certain large length values by the asn1 get length der function in GNU Libtasn1. This can be exploited by remote attackers to cause a denial of service, resulting in heap memory corruption and application crash, or possibly have other unspecified impacts through a crafted ASN.1 structure.

Recommendations For GNU Libtasn1 versions prior to 2.12, update to version 2.12 or later to resolve the issue. For GnuTLS versions prior to 3.0.16, update to version 3.0.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the asn1 get length der function until a patch is available.