CVE-2014-3466

GnuTLS < 3.1.25, 3.2.x < 3.2.15, 3.3.x < 3.3.4 - Remote Code Execution via ServerHello Session ID

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2014-3466. PoCs published by azet.

AI-analyzed exploit summary This PoC exploits a buffer overflow in GnuTLS (CVE-2014-3466) by sending a maliciously crafted ServerHello message with an oversized session ID length, triggering a segmentation fault in vulnerable clients.

Description

Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.

Exploits (1)

nomisec WORKING POC 17 stars

by azet · poc

https://github.com/azet/CVE-2014-3466_PoC

View Code ZIP pw:eip

This PoC exploits a buffer overflow in GnuTLS (CVE-2014-3466) by sending a maliciously crafted ServerHello message with an oversized session ID length, triggering a segmentation fault in vulnerable clients.

Classification

Working Poc 95%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: GnuTLS (versions prior to fix for CVE-2014-3466)

No auth needed

Prerequisites: Vulnerable GnuTLS library linked to a client application (e.g., wget)

MITRE ATT&CK

T1499.004 - Application or System Exploitation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (33)

Core 33

Core References

Vendor Advisory x_refsource_confirm

http://www.gnutls.org/security.html

Various Sources x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=swg21678776

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2014/dsa-2944

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58340

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2229-1

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58642

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/67741

Vendor Advisory x_refsource_confirm

http://www.novell.com/support/kb/doc.php?id=7015302

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59057

Various Sources x_refsource_confirm

http://linux.oracle.com/errata/ELSA-2014-0595.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59086

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=1101932

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00002.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00007.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59021

Exploit, URL Repurposed x_refsource_misc

http://radare.today/technical-analysis-of-the-gnutls-hello-vulnerability/

Vendor Advisory x_refsource_confirm

http://www.novell.com/support/kb/doc.php?id=7015303

Various Sources x_refsource_confirm

http://linux.oracle.com/errata/ELSA-2014-0594.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58598

Various Sources x_refsource_confirm

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096155

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59838

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00015.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/60384

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0594.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59016

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00010.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/58601

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59408

Exploit, Patch x_refsource_confirm

https://www.gitorious.org/gnutls/gnutls/commit/688ea6428a432c39203d00acd1af0e7684e5ddfd

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1030314

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0595.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0684.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0815.html

Scores

EPSS 0.1122

EPSS Percentile 95.4%

Details

CWE

CWE-119

Status published

Products (46)

gnu/gnutls 3.3.0 (2 CPE variants)

gnu/gnutls 3.3.1

gnu/gnutls 3.3.2

gnu/gnutls 3.3.3

gnu/gnutls 3.1.0

gnu/gnutls 3.1.1

gnu/gnutls 3.1.2

gnu/gnutls 3.1.3

gnu/gnutls 3.1.4

gnu/gnutls 3.1.5

... and 36 more

Published Jun 03, 2014

Tracked Since Feb 18, 2026