Technical Analysis Of The GnuTLS Hello Vulnerability

Posted by xvilka on Sunday June 01, 2014 @05:01PM
from the radare.today dept.

http://radare.today/technical-analysis-of-the-gnutls-hello-vulnerability/

( 5 comments | 47 points | on HN )

Re:Technical Analysis Of The GnuTLS Hello Vulnerability by ElliotRodger on Sunday June 01, 2014 @07:54PM (#7831183)

> Two weeks ago, an interesting commit appeared in the GnuTLS repository.

This statement gives the impression that the code was quietly fixed without disclosing the vulnerability. In reality, the fix was done on 5/23, but it was not rebased and committed to the public repo until the bug was formally announced and the updated releases were ready:

    commit 688ea6428a432c39203d00acd1af0e7684e5ddfd
    Author:     Nikos Mavrogiannopoulos <[email protected]>
    AuthorDate: Fri May 23 19:50:31 2014 +0200
    Commit:     Nikos Mavrogiannopoulos <[email protected]>
    CommitDate: Thu May 29 19:00:01 2014 +0200
    
    Prevent memory corruption due to server hello parsing.

[ Parent | on HN ]

Re:Technical Analysis Of The GnuTLS Hello Vulnerability by kcbanner on Sunday June 01, 2014 @09:27PM (#7831430)

Thanks for the clarification, I was wondering about this!

[ Parent | on HN ]

Re:Technical Analysis Of The GnuTLS Hello Vulnerability by jmgrosen on Sunday June 01, 2014 @05:35PM (#7830780)

I hope to someday reach the level of expertise the author of this post has... for now, though, I think I'll stick to playing CTFs.

Fantastic work, even if (s)he didn't find the vulnerability her-/himself.

[ Parent | on HN ]

Re:Technical Analysis Of The GnuTLS Hello Vulnerability by gwern on Sunday June 01, 2014 @05:34PM (#7830776)

404 not found now?

[ Parent | on HN ]

Re:Technical Analysis Of The GnuTLS Hello Vulnerability by jvoisin on Sunday June 01, 2014 @05:02PM (#7830665)

Awesome!

[ Parent | on HN ]