CVE:CVE-2014-8564
CNNVD:CNNVD-201411-204
GnuTLS是比利时Nikos Mavrogiannopoulos和瑞典Simon Josefsson软件开发者共同研发的一个免费的用于实现SSL、TLS和DTLS协议的安全通信库。
GnuTLS的gnutls_ecc.c文件中的‘_gnutls_ecc_ansi_x963_export’函数存在安全漏洞。远程攻击者可借助特制的Elliptic Curve Cryptography(ECC)证书或certificate signing requests(CSR)利用该漏洞造成拒绝服务（越边界写入）。以下版本受到影响：GnuTLS 3.1.28之前3.x版本，3.2.20之前3.2.x版本，3.3.10之前3.3.x版本。
solution:Upgrade gnu gnutls to a higher version than 3.0,3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,3.0.8,3.0.9,3.0.10,3.0.11,3.0.12,3.0.13,3.0.14,3.0.15,3.0.16,3.0.17,3.0.18,3.0.19,3.0.20,3.0.21,3.0.22,3.0.23,3.0.24,3.0.25,3.0.26,3.0.27,3.0.28,3.1.0,3.1.1,3.1.2,3.1.3,3.1.4,3.1.5,3.1.6,3.1.7,3.1.8,3.1.9,3.1.10,3.1.11,3.1.12,3.1.13,3.1.14,3.1.15,3.1.16,3.1.17,3.1.18,3.1.19,3.1.20,3.1.21,3.1.22,3.1.23,3.1.24,3.1.25,3.1.26,3.1.27,3.2.0,3.2.1,3.2.2,3.2.3,3.2.4,3.2.5,3.2.6,3.2.7,3.2.8,3.2.8.1,3.2.9,3.2.10,3.2.11,3.2.12,3.2.12.1,3.2.13,3.2.14,3.2.15,3.2.16,3.2.17,3.2.18,3.2.19,3.3.0,3.3.0:pre0,3.3.1,3.3.2,3.3.3,3.3.4,3.3.5,3.3.6,3.3.7,3.3.8,3.3.9,and avoid the version 3.0,3.0.0,3.0.1,3.0.2,3.0.3,3.0.4,3.0.5,3.0.6,3.0.7,3.0.8,3.0.9,3.0.10,3.0.11,3.0.12,3.0.13,3.0.14,3.0.15,3.0.16,3.0.17,3.0.18,3.0.19,3.0.20,3.0.21,3.0.22,3.0.23,3.0.24,3.0.25,3.0.26,3.0.27,3.0.28,3.1.0,3.1.1,3.1.2,3.1.3,3.1.4,3.1.5,3.1.6,3.1.7,3.1.8,3.1.9,3.1.10,3.1.11,3.1.12,3.1.13,3.1.14,3.1.15,3.1.16,3.1.17,3.1.18,3.1.19,3.1.20,3.1.21,3.1.22,3.1.23,3.1.24,3.1.25,3.1.26,3.1.27,3.2.0,3.2.1,3.2.2,3.2.3,3.2.4,3.2.5,3.2.6,3.2.7,3.2.8,3.2.8.1,3.2.9,3.2.10,3.2.11,3.2.12,3.2.12.1,3.2.13,3.2.14,3.2.15,3.2.16,3.2.17,3.2.18,3.2.19,3.3.0,3.3.0:pre0,3.3.1,3.3.2,3.3.3,3.3.4,3.3.5,3.3.6,3.3.7,3.3.8,3.3.9; Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_hpc_node to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0; Upgrade opensuse opensuse to a higher version than 12.3,13.1,13.2,and avoid the version 12.3,13.1,13.2; Upgrade canonical ubuntu_linux to a higher version than 14.10,and avoid the version 14.10