Bug 957568 - (CVE-2015-8313) VUL-0: CVE-2015-8313: gnutls: First byte of the padding in CBC mode is not checked
(CVE-2015-8313)
VUL-0: CVE-2015-8313: gnutls: First byte of the padding in CBC mode is not ch...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P5 - None : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/159295/
CVSSv2:SUSE:CVE-2015-8313:2.6:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-12-02 12:45 UTC by Marcus Meissner
Modified: 2016-01-12 10:54 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
42_CVE-2015-8313.diff (764 bytes, patch)
2015-12-02 12:46 UTC, Marcus Meissner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2015-12-02 12:45:53 UTC
via debian

Description: Fix off by one issue in padding check (CVE-2015-8313)

This could potentially be used for Padding Oracle attacks against gnutls.

https://blog.hboeck.de/uploads/gnutls-2-fix-small-poodle.diff

References:
http://www.debian.org/security/2015/dsa-3408
Comment 1 Marcus Meissner 2015-12-02 12:46:14 UTC
Created attachment 658081 [details]
42_CVE-2015-8313.diff

debian patch
Comment 2 Marcus Meissner 2015-12-02 12:52:57 UTC
SLE12 with gnutls 3.2.15 has slightly different code and is fixed.

SLES 10 , SLES 11 are affected.

(actually SLES 12 is fixed better as it has a constant time padding check, which the old code does not have)

Issue is related to CVE-2013-1619.
Comment 3 Vítězslav Čížek 2015-12-02 13:12:38 UTC
https://blog.hboeck.de/archives/877-A-little-POODLE-left-in-GnuTLS-old-versions.html

SLE-11 code omits two bytes:
561       if (ver >= GNUTLS_TLS1 && pad_failed == 0)
562         for (i = 2; i < pad; i++)
Comment 4 SMASH SMASH 2015-12-02 13:34:32 UTC
An update workflow for this issue was started.

This issue was rated as "moderate".
Please submit fixed packages until "Dec. 16, 2015".

When done, reassign the bug to "security-team@suse.de".
/update/121076/.
Comment 5 Swamp Workflow Management 2015-12-02 13:35:52 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-12-16.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62360
Comment 6 Swamp Workflow Management 2015-12-02 13:37:58 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-12-16.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62361
Comment 7 Swamp Workflow Management 2015-12-02 13:39:38 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2015-12-16.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62362
Comment 11 Swamp Workflow Management 2016-01-11 19:12:12 UTC
SUSE-SU-2016:0077-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 924828,947271,957568
CVE References: CVE-2015-2806,CVE-2015-8313
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Server 11-SP4 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Server 11-SP3 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise High Availability Extension 11-SP4 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise High Availability Extension 11-SP3 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    gnutls-2.4.1-24.39.60.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    gnutls-2.4.1-24.39.60.1