PT-2012-5664 · Ietf+7 · Tls+7

Juliano Rizzo + 1 · Published 1999-01-01 · Updated 2024-06-15 · CVE-2012-4929

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TLS protocol versions 1.2 and earlier Mozilla Firefox (affected versions not specified) Google Chrome (affected versions not specified) Qt (affected versions not specified)

Description The issue allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, also known as a "CRIME" attack.

Recommendations For TLS protocol versions 1.2 and earlier, consider disabling TLS compression until a patch is available. For Mozilla Firefox, update to a version that properly obfuscates the length of unencrypted data. For Google Chrome, update to a version that properly obfuscates the length of unencrypted data. For Qt, update to a version that properly obfuscates the length of unencrypted data.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CESA-2013_0587

CVE-2012-4929

DLA-0008-1

DLA-400-1

DSA-2579-1

DSA-2626-1

DSA-2627-1

DSA-3253-1

HPSBUX02866

LOWSTRENGTHCIPHERSUITESCHECK

OPENSUSE-SU-2024:10180-1

OPENSUSE-SU-2024:10235-1

OPENSUSE-SU-2024:10263-1

OPENSUSE-SU-2024:10271-1

OPENSUSE-SU-2024:10329-1

OPENSUSE-SU-2024:10529-1

OPENSUSE-SU-2024:10531-1

OPENSUSE-SU-2024:11127-1

RHSA-2013:0587

RHSA-2013:0636

RHSA-2013_0587

RHSA-2014:0416

ROSA-SA-2024-2371

SUSE-FU-2022:0445-1

SUSE-SU-2012_1428-1

Affected Products

Centos

Google Chrome

Hp-Ux

Firefox

Qt

Red Hat

Suse

Tls

References · 221

• 🔥 https://github.com/mpgn/CRIME-poc · Exploit
• 🔥 https://github.com/anthophilee/A2SV--SSL-VUL-Scan · Exploit
• https://osv.dev/vulnerability/DSA-3253-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-4929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0169 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5592 · Security Note
• http://debian.org/security/2013/dsa-2627 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10263-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1898-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-0587.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10531-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1628-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10329-1 · Vendor Advisory