News for hackers. Stuff that matters.
Re:CVE-2014-3466: GnuTLS buffer overflow by rikacomet on Sunday June 01, 2014 @10:50AM (#7829317)
If I remember correctly, something similar demonstrated by someone(a bounty hunter) a few months back, and was featured on HN front page as well.

I remember it was maybe related to Facebook, and not to TLS/SSL specifically. Very similar.. sending excessively long session id values.

I wonder if excessively long session id values can break something else as well?

[ Parent | on HN ]
Re:CVE-2014-3466: GnuTLS buffer overflow by farness on Sunday June 01, 2014 @12:04PM (#7829614)
Excessively long data is a cornerstone of security vulnerabilities.

> I wonder if excessively long session id values can break something else as well?

Yes, with p~=1.

[ Parent | on HN ]
Re:CVE-2014-3466: GnuTLS buffer overflow by rikacomet on Sunday June 01, 2014 @01:57PM (#7830028)
Indeed it is, but what I was curious to know more about the particular case of session IDs.
[ Parent | on HN ]
Re:CVE-2014-3466: GnuTLS buffer overflow by azet on Sunday June 01, 2014 @04:43PM (#7830578)
PoC (not weaponized and ugly code due to lack of time): https://github.com/azet/CVE-2014-3466_PoC

hf.

[ Parent | on HN ]
Re:CVE-2014-3466: GnuTLS buffer overflow by 0x0 on Sunday June 01, 2014 @08:55AM (#7828990)
At least it's a client only vulnerability. Hope your servers don't make outbound connections! :)
[ Parent | on HN ]
Re:CVE-2014-3466: GnuTLS buffer overflow by SoftwareMaven on Sunday June 01, 2014 @09:36AM (#7829094)
Because clients don't get re-routed through malicious redirects to unexpected servers. The consolation is that GnuTLS isn't used for popular web browsers.
[ Parent | on HN ]