PT-2012-5664 · Ietf+7 · Tls+7
Juliano Rizzo
+1
·
Publicado
1999-01-01
·
Atualizado
2024-06-15
·
CVE-2012-4929
CVSS v2.0
2.6
Baixa
| Vetor | AV:N/AC:H/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
TLS protocol versions 1.2 and earlier
Mozilla Firefox (affected versions not specified)
Google Chrome (affected versions not specified)
Qt (affected versions not specified)
Description
The issue allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, also known as a "CRIME" attack.
Recommendations
For TLS protocol versions 1.2 and earlier, consider disabling TLS compression until a patch is available.
For Mozilla Firefox, update to a version that properly obfuscates the length of unencrypted data.
For Google Chrome, update to a version that properly obfuscates the length of unencrypted data.
For Qt, update to a version that properly obfuscates the length of unencrypted data.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Google Chrome
Hp-Ux
Firefox
Qt
Red Hat
Suse
Tls