Stack Exhaustion Vulnerability in libtasn1: CVE-2018-6003
Summary
ALPINE-CVE-2018-6003: An issue was discovered in the _asn1_decode_simple_ber function in decoding.c in GNU Libtasn1 before 4.13. Affects libtasn1 versions < 4.13-r0. Fixed in 4.13-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libtasn1 is a library that provides support for ASN.1 (Abstract Syntax Notation One) encoding and decoding. It is widely used in various applications for handling data structures defined in ASN.1. The library is essential for ensuring proper data serialization and deserialization, making it a critical component in many software systems. However, prior to version 4.13, libtasn1 contained a vulnerability that could lead to stack exhaustion due to unlimited recursion in its BER (Basic Encoding Rules) decoder.
Vulnerability Detail
The vulnerability, identified as CVE-2018-6003, originates from the _asn1_decode_simple_ber function in decoding.c of GNU Libtasn1 before version 4.13. This flaw allows for unlimited recursion during the decoding process, which can lead to stack exhaustion and result in a Denial of Service (DoS) condition. Attackers can exploit this vulnerability by crafting specific input that triggers the recursive decoding, causing the application to crash or become unresponsive.
How To Fix
Minimum fixed version
4.13-r0
This is the first release that contains the fix.
sudo apk add --upgrade libtasn1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the input size to the BER decoder to prevent excessive recursion. However, this is not a complete fix and should only be used until the package can be updated.
Conclusion
CVE-2018-6003 represents a significant vulnerability in the libtasn1 library that can lead to stack exhaustion and Denial of Service. It is crucial for users and developers to update to the patched version (4.13 or later) to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for libtasn1 →
FAQ
CVE-2018-6003 is a vulnerability in the libtasn1 library that allows for stack exhaustion due to unlimited recursion in the BER decoder.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities without needing to install anything.
The CVSS score for CVE-2018-6003 is 7.5, indicating a high severity level.
The primary impact is Denial of Service (DoS), where an attacker can cause the application to crash or become unresponsive by exploiting the vulnerability.
While the best solution is to update to the patched version, you can implement input size restrictions as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for libtasn1.
