Gnu TLS Cryptographic Bug

network protocol
Written By Chris Wellens

The Red Hat Bugzilla report explained: 

“A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or possibly execute arbitrary code.”

IWL used our Maxwell Pro TLS Test Suite to test one version of the GnuTLS library. It failed 39 out of 116 of our tests! Fortunately most of those failures are benign, typically caused by responding with the wrong response to a malformed or out of sequence message. Others, such as improper handling of buffer overruns, can be open to exploits. Because this bug attacks clients rather than servers, it requires extra steps at subterfuge to be taken by attackers to exploit it.

The key point: anyone using our Maxwell Pro TLS Test Suite would have identified this bug, thanks to our test for session ID overflow.  

So what do we have to do to get people to test their software implementations?

Chris Wellens http://carboneraneighbors.com
Previous

Testing the Autonomous Car
Next

My Dinner with Guido (of Python Fame)