The Red Hat Bugzilla report explained:
“A malicious server could use this flaw to send an excessively long session ID value, which would trigger a buffer overflow in a connecting TLS/SSL client application using GnuTLS, causing the client application to crash or possibly execute arbitrary code.”
InterWorking Labs used our Maxwell Pro TLS Test Suite to test one version of the GnuTLS library. It failed 39 out of 116 of our tests! Fortunately most of those failures are benign, typically caused by responding with the wrong response to a malformed or out of sequence message. Others, such as improper handling of buffer overruns, can be open to exploits. Because this bug attacks clients rather than servers, it requires extra steps at subterfuge to be taken by attackers to exploit it.
The key point: anyone using our Maxwell Pro TLS Test Suite would have identified this bug, thanks to our test for session ID overflow.
So what do we have to do to get people to test their software implementations?