PT-2012-6242 · Google · Google Cityhash

Publicado 2012-11-28 · Atualizado 2012-11-29 · CVE-2012-6051

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Google CityHash (affected versions not specified)

Description The issue allows context-dependent attackers to cause a denial of service, specifically CPU consumption, via crafted input to an application that maintains a hash table. This is demonstrated by a universal multicollision attack, which exploits the hash collision predictability in Google CityHash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-6051

Produtos afetados

Google Cityhash

Referências · 5

• http://code.google.com/p/cityhash/source/browse/trunk/NEWS · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6051 · Nota de Segurança
• https://131002.net/data/talks/appsec12_slides.pdf · Nota
• http://2012.appsec-forum.ch/conferences/#c17 · Nota
• http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf · Nota