PT-2012-1868 · Openssl · Openssl

Vincent Danen · Publicado 2012-01-27 · Atualizado 2012-11-06 · CVE-2011-4354

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 0.9.8h on 32-bit platforms

Description The issue involves an incorrect modular reduction algorithm in the implementation of the P-256 and P-384 NIST elliptic curves in certain circumstances, specifically with ECDH or ECDHE cipher suites. This allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.

Recommendations For OpenSSL versions prior to 0.9.8h on 32-bit platforms, update to version 0.9.8h or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2011-4354

DSA-2390-1

Produtos afetados

Openssl

Referências · 13

• http://marc.info/?t=119271238800004 · Nota
• http://crypto.di.uminho.pt/CACE/CT-RSA2012-openssl-src.zip · Nota
• http://debian.org/security/2012/dsa-2390 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-4354 · Aviso do Fabricante
• http://cvs.openssl.org/filediff?f=openssl/crypto/bn/bn_nist.c&v1=1.14&v2=1.21 · Nota
• http://rt.openssl.org/Ticket/Display.html?id=1593&user=guest&pass=guest · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4354 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=757909 · Nota
• http://openwall.com/lists/oss-security/2011/12/01/6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4354 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4354 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-4354 · Aviso do Fabricante
• http://eprint.iacr.org/2011/633 · Nota