Slashdot Mirror

← Back to Stories (view on slashdot.org)

Bug In the GnuTLS Library Leaves Many OSs and Apps At Risk

Posted by Soulskill on from the feeling-secure-is-the-biggest-bug dept.

New submitter williamyf writes "According to this article at Ars Technica, '[A] bug in the GnuTLS library makes it trivial for attackers to bypass secure sockets layer (SSL) and Transport Layer Security (TLS) protections available on websites that depend on the open source package. Initial estimates included in Internet discussions such as this one indicate that more than 200 different operating systems or applications rely on GnuTLS to implement crucial SSL and TLS operations, but it wouldn't be surprising if the actual number is much higher. Web applications, e-mail programs, and other code that use the library are vulnerable to exploits that allow attackers monitoring connections to silently decode encrypted traffic passing between end users and servers.' The coding error may have been present since 2005."

4 of 231 comments (clear)

  1. We all knew it was coming... by neiras · · Score: 5, Informative

    From February 16 2008: Howard Chu of OpenLDAP: GnuTLS Considered Harmful

    Looking across more of their APIs, I see that the code makes liberal use of strlen and strcat, when it needs to be using counted-length data blobs everywhere. In short, the code is fundamentally broken; most of its external and internal APIs are incapable of passing binary data without mangling it. The code is completely unsafe for handling binary data, and yet the nature of TLS processing is almost entirely dependent on secure handling of binary data.

    Incredible that GnuTLS is used anywhere at all. It's just mind boggling.

    1. Re:We all knew it was coming... by sk999 · · Score: 4, Informative

      Just downloaded the latest patched source code. Here's the summary:

      find . -name '*.c' | xargs grep strlen | wc -l
      522

      find . -name '*.c' | xargs grep strcat | wc -l
      44

      Just as flawed as ever.

  2. Re:AHAHAHAHAH by bonch · · Score: 5, Informative

    The bug was found due to observed behavior, not due to a code review.

  3. Incompatible license by tepples · · Score: 5, Informative

    The OpenSSL license is not compatible with the GNU General Public License.