Vulnerabilities > CVE-2018-1000654 - Unspecified vulnerability in GNU Libtasn1 4.12/4.13
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 2 |
Nessus
NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2020-2_0-0236_LIBTASN1.NASL description An update of the libtasn1 package has been released. last seen 2020-05-08 modified 2020-05-05 plugin id 136329 published 2020-05-05 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/136329 title Photon OS 2.0: Libtasn1 PHSA-2020-2.0-0236 NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-1372-2.NASL description This update for libtasn1 fixes the following issues : Security issue fixed : CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 126495 published 2019-07-05 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126495 title SUSE SLED15 / SLES15 Security Update : libtasn1 (SUSE-SU-2019:1372-2) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2020-3_0-0081_LIBTASN1.NASL description An update of the libtasn1 package has been released. last seen 2020-04-30 modified 2020-04-21 plugin id 135777 published 2020-04-21 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/135777 title Photon OS 3.0: Libtasn1 PHSA-2020-3.0-0081 NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-1372-1.NASL description This update for libtasn1 fixes the following issues : Security issue fixed : CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 125541 published 2019-05-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125541 title SUSE SLED15 / SLES15 Security Update : libtasn1 (SUSE-SU-2019:1372-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-1379-1.NASL description This update for libtasn1 fixes the following issues : Security issues fixed : CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 125592 published 2019-05-30 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125592 title SUSE SLED12 / SLES12 Security Update : libtasn1 (SUSE-SU-2019:1379-1) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-1498.NASL description This update for libtasn1 fixes the following issues : Security issue fixed : - CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 125696 published 2019-06-04 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125696 title openSUSE Security Update : libtasn1 (openSUSE-2019-1498) NASL family PhotonOS Local Security Checks NASL id PHOTONOS_PHSA-2020-1_0-0292_LIBTASN1.NASL description An update of the libtasn1 package has been released. last seen 2020-05-18 modified 2020-05-13 plugin id 136554 published 2020-05-13 reporter This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/136554 title Photon OS 1.0: Libtasn1 PHSA-2020-1.0-0292 NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-1510.NASL description This update for libtasn1 fixes the following issues : Security issues fixed : - CVE-2018-1000654: Fixed a denial of service in the asn1 parser (bsc#1105435). - CVE-2017-6891: Fixed a stack overflow in asn1_find_node() (bsc#1040621). This update was imported from the SUSE:SLE-12-SP3:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 125757 published 2019-06-07 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125757 title openSUSE Security Update : libtasn1 (openSUSE-2019-1510)
References
- https://gitlab.com/gnutls/libtasn1/issues/4
- http://www.securityfocus.com/bid/105151
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E