CVE-2010-0731 Memory corruption in n/a
Remote attackers can bypass CRL checks and trigger a stack-based buffer overflow via crafted X.509 certificates on big-endian 64-bit systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-0731?
CVE-2010-0731 is a high-severity memory corruption vulnerability in Gnu Gnutls, published on 26 Mar 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.
Weakness: CWE-119
Which versions are affected by CVE-2010-0731?
It affects 1 product.
Products include Gnu Gnutls.
How do I fix CVE-2010-0731?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2010-0731 being exploited?
There is no known exploitation of CVE-2010-0731 in the wild and no public exploit code.
Other vulnerabilities in Gnu Gnutls
Sources
Also known as GHSA-g8xp-5hv7-77f4.