oss-sec mailing list archives
Heap overflow / invalid read in Libtasn1 before 4.5 (TFPA 005/2015)
From: Hanno Böck <hanno () hboeck de>
Date: Thu, 30 Apr 2015 14:46:42 +0200
https://blog.fuzzing-project.org/9-Heap-overflow-invalid-read-in-Libtasn1-TFPA-0052015.html While fuzzing GnuTLS I discovered a malformed certificate input sample that would cause a heap overflow read of 99 bytes in the DER decoding functions of Libtasn1. The heap overflow happens in the function _asn1_extract_der_octet(). This issue was reported to the Libtasn1 developer on 16th April. A fix was committed on 20th April and is part of the Libtasn1 4.5 release. This issue was found with american fuzzy lop and address sanitizer. http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commitdiff;h=f979435823a02f842c41d49cd41cc81f25b5d677 Git commit / fix https://lists.gnu.org/archive/html/help-libtasn1/2015-04/msg00000.html Libtasn1 4.5 release notes https://crashes.fuzzing-project.org/TFPA-2015-005-libtasn1-4.4-heap-overflow.crt Sample malformed certificate exposing heap overflow (test with certtool -i --inder --infile=[sample] and address sanitizer or valgrind) -- Hanno Böck http://hboeck.de/ mail/jabber: hanno () hboeck de GPG: BBB51E42
Attachment:
_bin
Description: OpenPGP digital signature
Current thread:
- Heap overflow / invalid read in Libtasn1 before 4.5 (TFPA 005/2015) Hanno Böck (Apr 30)
- Re: Heap overflow / invalid read in Libtasn1 before 4.5 (TFPA 005/2015) cve-assign (Apr 30)