CVE-2011-4108

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
References
Link Resource
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
http://marc.info/?l=bugtraq&m=132750648501816&w=2
http://marc.info/?l=bugtraq&m=132750648501816&w=2
http://marc.info/?l=bugtraq&m=133951357207000&w=2
http://marc.info/?l=bugtraq&m=133951357207000&w=2
http://marc.info/?l=bugtraq&m=134039053214295&w=2
http://marc.info/?l=bugtraq&m=134039053214295&w=2
http://rhn.redhat.com/errata/RHSA-2012-1306.html
http://rhn.redhat.com/errata/RHSA-2012-1307.html
http://rhn.redhat.com/errata/RHSA-2012-1308.html
http://secunia.com/advisories/48528
http://secunia.com/advisories/57260
http://secunia.com/advisories/57353
http://support.apple.com/kb/HT5784
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
http://www.debian.org/security/2012/dsa-2390
http://www.isg.rhul.ac.uk/~kp/dtls.pdf
http://www.kb.cert.org/vuls/id/737740 US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2012:006
http://www.mandriva.com/security/advisories?name=MDVSA-2012:007
http://www.openssl.org/news/secadv_20120104.txt Vendor Advisory
https://security.paloaltonetworks.com/CVE-2011-4108
http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
http://marc.info/?l=bugtraq&m=132750648501816&w=2
http://marc.info/?l=bugtraq&m=132750648501816&w=2
http://marc.info/?l=bugtraq&m=133951357207000&w=2
http://marc.info/?l=bugtraq&m=133951357207000&w=2
http://marc.info/?l=bugtraq&m=134039053214295&w=2
http://marc.info/?l=bugtraq&m=134039053214295&w=2
http://rhn.redhat.com/errata/RHSA-2012-1306.html
http://rhn.redhat.com/errata/RHSA-2012-1307.html
http://rhn.redhat.com/errata/RHSA-2012-1308.html
http://secunia.com/advisories/48528
http://secunia.com/advisories/57260
http://secunia.com/advisories/57353
http://support.apple.com/kb/HT5784
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
http://www.debian.org/security/2012/dsa-2390
http://www.isg.rhul.ac.uk/~kp/dtls.pdf
http://www.kb.cert.org/vuls/id/737740 US Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2012:006
http://www.mandriva.com/security/advisories?name=MDVSA-2012:007
http://www.openssl.org/news/secadv_20120104.txt Vendor Advisory
https://security.paloaltonetworks.com/CVE-2011-4108
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.1c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.2b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.4:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.5:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.5a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6e:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6f:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6g:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6h:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6h:bogus:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6i:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6j:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6k:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6l:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.6m:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7h:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7i:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7k:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7l:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.7m:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8h:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8i:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8j:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8k:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8l:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8m:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8n:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8o:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8p:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:0.9.8q:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*

History

21 Nov 2024, 01:31

Type Values Removed Values Added
References () http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc - () http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc -
References () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 - () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041 -
References () http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html - () http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html -
References () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html - () http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html -
References () http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html - () http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html -
References () http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html - () http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html -
References () http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html - () http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html -
References () http://marc.info/?l=bugtraq&m=132750648501816&w=2 - () http://marc.info/?l=bugtraq&m=132750648501816&w=2 -
References () http://marc.info/?l=bugtraq&m=133951357207000&w=2 - () http://marc.info/?l=bugtraq&m=133951357207000&w=2 -
References () http://marc.info/?l=bugtraq&m=134039053214295&w=2 - () http://marc.info/?l=bugtraq&m=134039053214295&w=2 -
References () http://rhn.redhat.com/errata/RHSA-2012-1306.html - () http://rhn.redhat.com/errata/RHSA-2012-1306.html -
References () http://rhn.redhat.com/errata/RHSA-2012-1307.html - () http://rhn.redhat.com/errata/RHSA-2012-1307.html -
References () http://rhn.redhat.com/errata/RHSA-2012-1308.html - () http://rhn.redhat.com/errata/RHSA-2012-1308.html -
References () http://secunia.com/advisories/48528 - () http://secunia.com/advisories/48528 -
References () http://secunia.com/advisories/57260 - () http://secunia.com/advisories/57260 -
References () http://secunia.com/advisories/57353 - () http://secunia.com/advisories/57353 -
References () http://support.apple.com/kb/HT5784 - () http://support.apple.com/kb/HT5784 -
References () http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 - () http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 -
References () http://www.debian.org/security/2012/dsa-2390 - () http://www.debian.org/security/2012/dsa-2390 -
References () http://www.isg.rhul.ac.uk/~kp/dtls.pdf - () http://www.isg.rhul.ac.uk/~kp/dtls.pdf -
References () http://www.kb.cert.org/vuls/id/737740 - US Government Resource () http://www.kb.cert.org/vuls/id/737740 - US Government Resource
References () http://www.mandriva.com/security/advisories?name=MDVSA-2012:006 - () http://www.mandriva.com/security/advisories?name=MDVSA-2012:006 -
References () http://www.mandriva.com/security/advisories?name=MDVSA-2012:007 - () http://www.mandriva.com/security/advisories?name=MDVSA-2012:007 -
References () http://www.openssl.org/news/secadv_20120104.txt - Vendor Advisory () http://www.openssl.org/news/secadv_20120104.txt - Vendor Advisory
References () https://security.paloaltonetworks.com/CVE-2011-4108 - () https://security.paloaltonetworks.com/CVE-2011-4108 -

Information

Published : 2012-01-06 01:55

Updated : 2024-11-21 01:31


NVD link : CVE-2011-4108

Mitre link : CVE-2011-4108

CVE.ORG link : CVE-2011-4108


JSON object : View

Products Affected

openssl

  • openssl
CWE
CWE-310

Cryptographic Issues