CVE-2008-1950 Integer overflow in n/a
Remote attackers can cause a denial of service via a crafted TLS Client Hello message exploiting an integer signedness error in GnuTLS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2008-1950?
CVE-2008-1950 is a medium-severity vulnerability in Gnu Gnutls, published on 21 May 2008. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer signedness error in the _gnutls_ciphertext2compressed function in lib/gnutls_cipher.c in libgnutls in GnuTLS before 2.2.4 allows remote attackers to cause a denial of service (buffer over-read and crash) via a certain integer value in the Random field in an encrypted Client Hello message within a TLS record with an invalid Record Length, which leads to an invalid cipher padding length, aka GNUTLS-SA-2008-1-3.
Weakness: CWE-189
Which versions are affected by CVE-2008-1950?
It affects 1 product.
Products include Gnu Gnutls.
How do I fix CVE-2008-1950?
Upgrade to a fixed version.
Is CVE-2008-1950 being exploited?
There is no known exploitation of CVE-2008-1950 in the wild and no public exploit code.
Other vulnerabilities in Gnu Gnutls
Sources
Also known as GHSA-4qv6-g5fw-f876.