[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2012-4929Date: (C)2012-09-15   (M)2024-02-22


The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 2.6
Exploit Score: 4.9
Impact Score: 2.9
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: HIGH
Authentication: NONE
Confidentiality: PARTIAL
Integrity: NONE
Availability: NONE
  
Reference:
BID-55704
APPLE-SA-2013-06-04-1
DSA-2579
DSA-2627
DSA-3253
FEDORA-2013-4403
JVN#65273415
JVNDB-2016-000129
RHSA-2013:0587
SSRT101139
USN-1627-1
USN-1628-1
USN-1898-1
http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/
http://code.google.com/p/chromium/issues/detail?id=139744
http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html
http://news.ycombinator.com/item?id=4510829
http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor
http://support.apple.com/kb/HT5784
http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312
http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512
http://www.ekoparty.org/2012/thai-duong.php
http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
http://www.theregister.co.uk/2012/09/14/crime_tls_attack/
https://bugzilla.redhat.com/show_bug.cgi?id=857051
https://chromiumcodereview.appspot.com/10825183
https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls
https://gist.github.com/3696912
https://github.com/mpgn/CRIME-poc
https://threatpost.com/en_us/blogs/demo-crime-tls-attack-091212
openSUSE-SU-2012:1420
openSUSE-SU-2013:0143
openSUSE-SU-2013:0157
oval:org.mitre.oval:def:18920

CPE    4
cpe:/o:debian:debian_linux:7.0
cpe:/o:debian:debian_linux:8.0
cpe:/a:google:chrome
cpe:/a:mozilla:firefox
...
CWE    1
CWE-310
OVAL    19
oval:org.secpod.oval:def:107894
oval:org.secpod.oval:def:14154
oval:org.secpod.oval:def:701067
oval:org.secpod.oval:def:701066
...

© SecPod Technologies