PT-2012-3826 · Openssl+3 · Openssl+3

Published 2012-04-24 · Updated 2018-01-05 · CVE-2012-2131

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenSSL version 0.9.8v

Description The issue is caused by multiple integer signedness errors in the crypto/buffer/buffer.c file, allowing remote attackers to conduct buffer overflow attacks via crafted DER data, such as an X.509 certificate or an RSA public key. This can cause a denial of service due to memory corruption or possibly have other unspecified impacts.

Recommendations For OpenSSL version 0.9.8v, consider updating to a newer version to mitigate the risk, as this issue exists due to an incomplete fix in previous versions. As a temporary workaround, restrict the use of crafted DER data, such as X.509 certificates or RSA public keys, to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2012-2131

DSA-2454-2

HPSBUX02782

Affected Products

Hp-Ux

Ibm Aix

Openssl

Suse

References · 43

• 🔥 https://exploit-db.com/exploits/18756 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-7250 · Security Note
• http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06479 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-2131 · Security Note
• https://bdu.fstec.ru/vul/2015-08805 · Security Note
• http://openssl.org/news/secadv_20120424.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06477 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619 · Security Note
• https://bdu.fstec.ru/vul/2015-08804 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1165 · Security Note
• https://bdu.fstec.ru/vul/2015-06476 · Security Note
• http://marc.info/?l=bugtraq&m=133728068926468&w=2 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2131 · Security Note