CVE-2008-2377

Severity Score

7.6

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Use-after-free vulnerability in the _gnutls_handshake_hash_buffers_clear function in lib/gnutls_handshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data that is improperly used when the peer calls gnutls_handshake within a normal session, leading to attempted access to a deallocated libgcrypt handle.

Vulnerabilidad de uso después de liberación en la función _gnutls_handshake_hash_buffers_clear de lib/gnutls_handshake.c en libgnutls de GnuTLS 2.3.5 hasta 2.4.0 permite a atacantes remotos provocar una denegación de servicio (caida) o posiblemente ejecutar código de su elección a través de transmisiones TLS de datos que no son usadas apropiadamente cuando las llamadas pares gnutls_handshake dentro de una sesión normal, conducen a intentos de acceso a manejadores libgcrypt no asignados.

*Credits: N/A

CVSS Scores

NISTv2 7.6

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-05-21 CVE Reserved
2008-08-08 CVE Published
2024-08-07 CVE Updated
2024-08-07 First Exploit
2024-08-14 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (8)

URL	Tag	Source
http://secunia.com/advisories/31505	Third Party Advisory
http://www.gnu.org/software/gnutls/security.html	X_refsource_confirm
http://www.securityfocus.com/bid/30713	Vdb Entry
http://www.vupen.com/english/advisories/2008/2398	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/44486	Vdb Entry
https://issues.rpath.com/browse/RPL-2650	X_refsource_confirm

URL	Date	SRC
http://www.nabble.com/Details-on-the-gnutls_handshake-local-crash-problem--GNUTLS-SA-2008-2--td18205022.html	2024-08-07

URL	Date	SRC
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947	2017-08-08

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				2.3.5 Search vendor "Gnu" for product "Gnutls" and version "2.3.5"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				2.3.6 Search vendor "Gnu" for product "Gnutls" and version "2.3.6"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				2.3.7 Search vendor "Gnu" for product "Gnutls" and version "2.3.7"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				2.3.8 Search vendor "Gnu" for product "Gnutls" and version "2.3.8"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				2.3.9 Search vendor "Gnu" for product "Gnutls" and version "2.3.9"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				2.4.0 Search vendor "Gnu" for product "Gnutls" and version "2.4.0"		-		Affected