Security Researchers Discover New SSL Flaw
Codenomicon, which found the Heartbleed flaw, discovered another SSL flaw, this time in the open-source GnuTLS library. GnuTLS is part of many Linux distros.Security firm Codenomicon has found a new Secure Sockets Layer (SSL) flaw in the GnuTLS open-source cryptographic library. Codenomicon rose to notoriety in April as the security firm that found and branded the Heartbleed flaw in the open-source OpenSSL cryptographic library. GnuTLS is not as widely deployed as OpenSSL, but it is part of many leading Linux distributions, including Red Hat. "A flaw was found in the way GnuTLS parsed session IDs from Server Hello packets of the TLS/SSL [Transport Layer Security/Secure Sockets Layer} handshake," Red Hat warns in a security advisory. "A malicious server could use this flaw to send an excessively long session ID value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code." The main GnuTLS project has issued updates for versions 3.1.25, 3.2.15 and 3.3.3 to correct the vulnerability. Joonas Kuorilehto of Codenomicon is credited by the GnuTLS project for reporting the flaw, technically identified as CVE-2014-3466.
The vulnerability is not directly comparable in scope to the Heartbleed flaw that Codenomicon helped discover back in April. The Heartbleed flaw was first made public April 7 and could have enabled an attacker to read information from a server that was protected with OpenSSL. OpenSSL is also significantly more deployed than GnuTLS, leaving hundreds of thousands of users still at risk a full month after it was first disclosed.