CVE-2011-4108

EPSS 15.76%
Veröffentlicht 06.01.2012 01:55:00
Zuletzt bearbeitet 16.06.2026 23:34:26
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 28

NVD 64 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

OpenSSL ≫ OpenSSL Version <= 0.9.8r

OpenSSL ≫ OpenSSL Version0.9.1c

OpenSSL ≫ OpenSSL Version0.9.2b

OpenSSL ≫ OpenSSL Version0.9.4

OpenSSL ≫ OpenSSL Version0.9.5

OpenSSL ≫ OpenSSL Version0.9.5a

OpenSSL ≫ OpenSSL Version0.9.6

OpenSSL ≫ OpenSSL Version0.9.6a

OpenSSL ≫ OpenSSL Version0.9.6b

OpenSSL ≫ OpenSSL Version0.9.6c

OpenSSL ≫ OpenSSL Version0.9.6d

OpenSSL ≫ OpenSSL Version0.9.6e

OpenSSL ≫ OpenSSL Version0.9.6f

OpenSSL ≫ OpenSSL Version0.9.6g

OpenSSL ≫ OpenSSL Version0.9.6h

OpenSSL ≫ OpenSSL Version0.9.6h Updatebogus

OpenSSL ≫ OpenSSL Version0.9.6i

OpenSSL ≫ OpenSSL Version0.9.6j

OpenSSL ≫ OpenSSL Version0.9.6k

OpenSSL ≫ OpenSSL Version0.9.6l

OpenSSL ≫ OpenSSL Version0.9.6m

OpenSSL ≫ OpenSSL Version0.9.7

OpenSSL ≫ OpenSSL Version0.9.7a

OpenSSL ≫ OpenSSL Version0.9.7b

OpenSSL ≫ OpenSSL Version0.9.7c

OpenSSL ≫ OpenSSL Version0.9.7d

OpenSSL ≫ OpenSSL Version0.9.7e

OpenSSL ≫ OpenSSL Version0.9.7f

OpenSSL ≫ OpenSSL Version0.9.7g

OpenSSL ≫ OpenSSL Version0.9.7h

OpenSSL ≫ OpenSSL Version0.9.7i

OpenSSL ≫ OpenSSL Version0.9.7j

OpenSSL ≫ OpenSSL Version0.9.7k

OpenSSL ≫ OpenSSL Version0.9.7l

OpenSSL ≫ OpenSSL Version0.9.7m

OpenSSL ≫ OpenSSL Version0.9.8

OpenSSL ≫ OpenSSL Version0.9.8a

OpenSSL ≫ OpenSSL Version0.9.8b

OpenSSL ≫ OpenSSL Version0.9.8c

OpenSSL ≫ OpenSSL Version0.9.8d

OpenSSL ≫ OpenSSL Version0.9.8e

OpenSSL ≫ OpenSSL Version0.9.8f

OpenSSL ≫ OpenSSL Version0.9.8g

OpenSSL ≫ OpenSSL Version0.9.8h

OpenSSL ≫ OpenSSL Version0.9.8i

OpenSSL ≫ OpenSSL Version0.9.8j

OpenSSL ≫ OpenSSL Version0.9.8k

OpenSSL ≫ OpenSSL Version0.9.8l

OpenSSL ≫ OpenSSL Version0.9.8m

OpenSSL ≫ OpenSSL Version0.9.8n

OpenSSL ≫ OpenSSL Version0.9.8o

OpenSSL ≫ OpenSSL Version0.9.8p

OpenSSL ≫ OpenSSL Version0.9.8q

OpenSSL ≫ OpenSSL Version <= 1.0.0e

OpenSSL ≫ OpenSSL Version1.0.0

OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta1

OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta2

OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta3

OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta4

OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta5

OpenSSL ≫ OpenSSL Version1.0.0a

OpenSSL ≫ OpenSSL Version1.0.0b

OpenSSL ≫ OpenSSL Version1.0.0c

OpenSSL ≫ OpenSSL Version1.0.0d

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	15.76%	0.964

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:P/I:N/A:N

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://secunia.com/advisories/57353

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

http://www.kb.cert.org/vuls/id/737740

US Government Resource

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

http://support.apple.com/kb/HT5784

http://marc.info/?l=bugtraq&m=133951357207000&w=2

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

http://marc.info/?l=bugtraq&m=132750648501816&w=2

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

http://marc.info/?l=bugtraq&m=134039053214295&w=2

http://rhn.redhat.com/errata/RHSA-2012-1306.html

http://rhn.redhat.com/errata/RHSA-2012-1307.html

http://rhn.redhat.com/errata/RHSA-2012-1308.html

http://secunia.com/advisories/48528

http://secunia.com/advisories/57260

http://www.debian.org/security/2012/dsa-2390

http://www.isg.rhul.ac.uk/~kp/dtls.pdf

http://www.mandriva.com/security/advisories?name=MDVSA-2012:006

http://www.mandriva.com/security/advisories?name=MDVSA-2012:007

http://www.openssl.org/news/secadv_20120104.txt

Vendor Advisory

https://security.paloaltonetworks.com/CVE-2011-4108

https://nvd.nist.gov/vuln/detail/CVE-2011-4108

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2011-4108

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2011-4108

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2011-4108