A recently discovered bug in the GnuTLS cryptographic code library puts users of Linux and hundreds of other open source packages at risk of surreptitious malware attacks until they incorporate a fix developers quietly pushed out late last week.
Maliciously configured servers can exploit the bug by sending malformed data to devices as they establish encrypted HTTPS connections. Devices that rely on an unpatched version of GnuTLS can then be remotely hijacked by malicious code of the attacker's choosing, security researchers who examined the fix warned. The bug wasn't patched until Friday, with the release of GnuTLS versions 3.1.25, 3.2.15, and 3.3.4. While the patch has been available for three days, it will protect people only when the GnuTLS-dependent software they use has incorporated it. With literally hundreds of packages dependent on the library multiple operating systems dependent on the library, that may take time.
"A flaw was found in the way GnuTLS parsed session IDs from ServerHello messages of the TLS/SSL handshake," an entry posted Monday on the Red Hat Bug Tracker explained. "A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or possibly execute arbitrary code."
A separate technical analysis here showed how the vulnerability can be exploited to execute malicious code of an attacker's choosing. There don't appear to be any obvious signs that an attack is under way, making it possible to exploit the vulnerability in surreptitious "drive-by" attacks. There are no reports that the vulnerability is actively being exploited in the wild. Still, readers should take steps immediately to ensure they're not using vulnerable GnuTLS versions.
The patch comes two months after the public disclosure of Heartbleed, a critical bug in the widely used OpenSSL crypto library. Unlike the GnuTLS flaw, Heartbleed allowed attackers to pluck passwords, cryptographic keys, and other sensitive data out of servers and client devices running a vulnerable version of the software. Almost immediately after Heartbleed became widely known, attackers were exploiting it to steal user passwords from Yahoo and other websites. In March, GnuTLS was patched against a separate bug that made it trivial for attackers to create counterfeit certificates for high-profile websites that would be accepted by GnuTLS as valid.The latest GnuTLS bug, which is formally cataloged as CVE-2014-3466, is the result of failures to properly check the boundary of session ID sizes. As a result, attackers can corrupt the memory contents of vulnerable devices by sending values that overflow the buffer. GnuTLS maintainers made passing reference to it on their site's security advisory page. It's not yet clear how long the bug has resided in GnuTLS, an open source program that anyone can download and probe for serious flaws just like this one.
reader comments
82