Security firm Codenomicon has found a new Secure Sockets Layer (SSL) flaw in the GnuTLS open-source cryptographic library. Codenomicon rose to notoriety in April as the security firm that found and branded the Heartbleed flaw in the open-source OpenSSL cryptographic library.
GnuTLS is not as widely deployed as OpenSSL, but it is part of many leading Linux distributions, including Red Hat.
“A flaw was found in the way GnuTLS parsed session IDs from Server Hello packets of the TLS/SSL [Transport Layer Security/Secure Sockets Layer} handshake,” Red Hat warns in a security advisory. “A malicious server could use this flaw to send an excessively long session ID value and trigger a buffer overflow in a connecting TLS/SSL client using GnuTLS, causing it to crash or, possibly, execute arbitrary code.”
The main GnuTLS project has issued updates for versions 3.1.25, 3.2.15 and 3.3.3 to correct the vulnerability. Joonas Kuorilehto of Codenomicon is credited by the GnuTLS project for reporting the flaw, technically identified as CVE-2014-3466.
The vulnerability is not directly comparable in scope to the Heartbleed flaw that Codenomicon helped discover back in April. The Heartbleed flaw was first made public April 7 and could have enabled an attacker to read information from a server that was protected with OpenSSL. OpenSSL is also significantly more deployed than GnuTLS, leaving hundreds of thousands of users still at risk a full month after it was first disclosed.
The complete impact of Heartbleed is still being measured, as new attacks against the vulnerability continue to be disclosed.
In a presentation May 28 in Lisbon, Portugal, security researcher Luis Grangeia disclosed new wireless attack vectors for Heartbleed. Grangeia’s attack, titled “Cupid,” leverages the Extensible Authentication Protocol (EAP), which complements SSL in order to exploit vulnerable users.
While GnuTLS is used primarily only on servers, OpenSSL is also widely used for VPNs as well as mobile devices, including those running on Google’s Android operating system. According to a report in April from security firm FireEye, as many as 150 million Android app downloads were at risk from the OpenSSL Heartbleed flaw.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.