« Volver al listado

CVE-2010-0731

Estado: ModificadaAlta (7.5)—

The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

GNU — Gnutls

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0731",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-03-26T18:30:00.437",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/39127",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0167.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/38959",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0713",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/1054",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=573028",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/39127",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0167.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/38959",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0713",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/1054",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=573028",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9759",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number."
    },
    {
      "lang": "es",
      "value": "La función gnutls_x509_crt_get_serial en la librería GnuTLS anterior a v1.2.1, cunado se está ejecutando sobre big-endian, plataformas de 64-bit, llama de a asn1_read_value con un puntero a un tipo de dato erróneo, y con una longitud errónea, lo que permite a atacantes remotos saltarse el control la lista de certificados revocados (CRL) y robocar un desbordamiento de de búfer basado en pila, a a través de un certificado X.509 manipulado, relativo a la extracción de un número de serie."
    }
  ],
  "lastModified": "2026-06-16T23:16:44.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E314F586-A086-480E-9BB9-D75ADDF8416D",
              "versionEndIncluding": "1.2.0"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FBB8F2C-498D-4D31-A7D7-9991BABEA7A6"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8856E1B1-8007-42E5-82EF-4700D4DEEDDA"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9CF40D3-CE03-4C2A-8EEF-EB5989291806"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC60D4CC-922C-4941-A400-0CBEAC7F31D1"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "754A0D19-A17A-4007-8355-497D14CFCBF9"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8140DBE1-8116-4051-9A57-07535586E0AF"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56D2DF7F-DCDD-486D-B906-F9DDE3A1DB70"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1CC840D-AD01-4EE2-8652-06742A6286BA"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.24:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84224A82-6D58-4000-A449-20C1632DAE85"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.0.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A466931C-769A-4A28-B072-10930CE655E6"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FEE50AC-8730-4F04-B57C-6BDF8B957F6D"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10F621DC-7967-4D97-A562-02E7033C89C2"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "776E5481-399F-45BC-AD20-A18508B03916"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63D7F972-9128-4A4D-8508-B38CE2F155E9"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5D56873-E8C5-4E4B-BB85-6DCF6526B453"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54FE4766-32D0-491E-8C71-5B998C468142"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F980857-2364-466A-8366-BD017D242222"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CDCF1F0-5A78-48FF-B4B0-303AE2420F6A"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.21:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A2E649D-5C45-4412-927B-E3EDCE07587C"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "066175C2-6E96-4BAE-B1A6-B23D25547FAC"
            },
            {
              "criteria": "cpe:2.3:a:gnu:gnutls:1.1.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "869D3010-67AE-44D0-BB8F-D9C410AEA1D8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "evaluatorSolution": "Per: http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/4230\r\n\r\n\"Please note that the problem was solved for GnuTLS 1.2.1, released on\r\n2005-04-04.  Also, 32-bit platforms are not affected.  I have added\r\ninformation about this on\r\n\r\nhttp://www.gnu.org/software/gnutls/security.html\r\n\r\nso that it contains the complete list of known security flaws.  I'm\r\nusing the keyword GNUTLS-SA-2010-1 for this.\""
}