CVE-2013-4487

Severity Score

5.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries. NOTE: this issue is due to an incomplete fix for CVE-2013-4466.

Error de superación de límite en dane_raw_tlsa en la librería DANE (libdane) de GnuTLS 3.1.x anterior a la versión 3.1.16 y 3.2.x anterior a 3.2.6 permite en servidores remotos provocar una denegación de servicio (corrupción de memoria) a través de una respuesta con más de 4 entradas DANE. NOTA: este problema se debe a una solución incompleta para CVE-2013-4466.

*Credits: N/A

CVSS Scores

NISTv2 5.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2013-06-12 CVE Reserved
2013-11-19 CVE Published
2024-09-16 CVE Updated
2024-09-16 First Exploit
2024-09-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-189: Numeric Errors

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
https://gitorious.org/gnutls/gnutls/commit/0dd5529509e46b11d5c0f3f26f99294e0e5fa6dc	2024-09-16

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2013/10/31/4	2018-10-30

URL	Date	SRC
http://lists.opensuse.org/opensuse-updates/2013-11/msg00064.html	2018-10-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.0 Search vendor "Gnu" for product "Gnutls" and version "3.2.0"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.1 Search vendor "Gnu" for product "Gnutls" and version "3.2.1"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.2 Search vendor "Gnu" for product "Gnutls" and version "3.2.2"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.3 Search vendor "Gnu" for product "Gnutls" and version "3.2.3"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.4 Search vendor "Gnu" for product "Gnutls" and version "3.2.4"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.2.5 Search vendor "Gnu" for product "Gnutls" and version "3.2.5"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.0 Search vendor "Gnu" for product "Gnutls" and version "3.1.0"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.1 Search vendor "Gnu" for product "Gnutls" and version "3.1.1"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.2 Search vendor "Gnu" for product "Gnutls" and version "3.1.2"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.3 Search vendor "Gnu" for product "Gnutls" and version "3.1.3"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.4 Search vendor "Gnu" for product "Gnutls" and version "3.1.4"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.5 Search vendor "Gnu" for product "Gnutls" and version "3.1.5"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.6 Search vendor "Gnu" for product "Gnutls" and version "3.1.6"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.7 Search vendor "Gnu" for product "Gnutls" and version "3.1.7"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.8 Search vendor "Gnu" for product "Gnutls" and version "3.1.8"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.9 Search vendor "Gnu" for product "Gnutls" and version "3.1.9"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.10 Search vendor "Gnu" for product "Gnutls" and version "3.1.10"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.11 Search vendor "Gnu" for product "Gnutls" and version "3.1.11"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.12 Search vendor "Gnu" for product "Gnutls" and version "3.1.12"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.13 Search vendor "Gnu" for product "Gnutls" and version "3.1.13"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.14 Search vendor "Gnu" for product "Gnutls" and version "3.1.14"		-		Affected
Gnu Search vendor "Gnu"		Gnutls Search vendor "Gnu" for product "Gnutls"				3.1.15 Search vendor "Gnu" for product "Gnutls" and version "3.1.15"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				13.1 Search vendor "Opensuse" for product "Opensuse" and version "13.1"		-		Affected