CVE-2015-3622

What it actually does

Out-of-bounds heap read in _asn1_extract_der_octet during DER octet string extraction from crafted ASN.1 certificate data, resulting in denial of service.

Why it matters to the business

Services and applications that parse untrusted certificates using the library may crash or become unavailable, affecting operations that depend on secure certificate handling.

How an attack unfolds

An attacker supplies a maliciously crafted certificate to any application linked against the vulnerable library; the _asn1_extract_der_octet function performs an out-of-bounds heap read when processing the certificate's ASN.1 structure, triggering a crash.

How to fix it

Upgrade GNU Libtasn1 to version 4.5 or newer on all affected systems and rebuild dependent packages; apply vendor patches for opensuse and fedora distributions.

How to confirm the fix worked

Confirm installed libtasn1 version is 4.5 or later via package manager or library metadata; test certificate parsing with known malformed inputs to verify absence of crashes.

Typical attack path

1. Locate a network service or application that uses libtasn1 to parse certificates
2. Generate a certificate containing malformed DER encoding targeting the octet extraction path
3. Deliver the certificate via TLS handshake, file upload, or other certificate ingestion mechanism
4. Trigger the vulnerable decoding path leading to heap read outside allocated bounds and process termination

How to detect it

Review application and system logs for abrupt crashes or segmentation faults during certificate validation or ASN.1 decoding operations; correlate with inbound certificate-bearing network traffic.

What your security team should do

• Immediately update libtasn1 across all environments given the public exploit availability
• Inventory all software depending on libtasn1 and schedule rebuilds after library upgrade
• Enable application crash reporting and monitor logs for ASN.1 parsing failures