CVE-2014-3467

What it actually does

Out-of-bounds read in the DER decoder of GNU Libtasn1 before 3.6 allows remote attackers to trigger denial of service via crafted ASN.1 data.

Why it matters to the business

Attackers can cause crashes in services relying on GnuTLS or Libtasn1, resulting in loss of availability for secure communications and related applications across many operating systems and devices.

How an attack unfolds

An attacker sends specially crafted ASN.1 DER-encoded data to a target service that uses the vulnerable decoder; the malformed input triggers an out-of-bounds read, crashing the process and achieving denial of service.

How to fix it

Upgrade GNU Libtasn1 to version 3.6 or later and ensure all dependent products such as GnuTLS are rebuilt or updated against the patched library; apply vendor patches for affected operating systems and appliances.

How to confirm the fix worked

Confirm installed Libtasn1 version is 3.6 or higher; test parsing of known malicious ASN.1 samples in an isolated environment to verify absence of crashes.

Typical attack path

1. Locate services or devices using vulnerable versions of GnuTLS or Libtasn1
2. Generate or obtain ASN.1 DER data crafted to exceed decoder bounds
3. Transmit the malicious data over the network to the target endpoint
4. Observe process crash or service unavailability confirming successful exploitation

How to detect it

Search system and application logs for segmentation faults or abrupt process terminations in GnuTLS-linked services; correlate with inbound network connections carrying ASN.1 structures around the time of crashes.

What your security team should do

• Inventory all systems using GnuTLS or Libtasn1 and schedule immediate upgrades
• Apply patches to reach Libtasn1 3.6+ on every affected platform
• Monitor application and system logs for ASN.1-related crashes as an interim detection measure