[Forgot Password]
Login  Register Subscribe

24128

 
 

131615

 
 

112965

 
 

909

 
 

87888

 
 

136

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML view JSON

CVE-2010-4252Date: (C)2010-12-06   (M)2018-04-14


OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 7.5
Exploit Score: 10.0
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
SECTRACK-1024823
SECUNIA-42469
BID-45163
ADV-2010-3120
ADV-2010-3122
IAVM:2012-A-0148
IAVM:2012-A-0153
SSA:2010-340-01
SSRT100339
SSRT100475
http://cvs.openssl.org/chngview?cn=20098
http://openssl.org/news/secadv_20101202.txt
http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
https://bugzilla.redhat.com/show_bug.cgi?id=659297
https://github.com/seb-m/jpake

CPE    76
cpe:/a:openssl:openssl:0.9.1c
cpe:/a:openssl:openssl:0.9.5a
cpe:/a:openssl:openssl:0.9.6:beta3
cpe:/a:openssl:openssl:0.9.6:beta1
...
CWE    1
CWE-287
OVAL    2
oval:org.secpod.oval:def:848
oval:org.secpod.oval:def:1092

© SecPod Technologies