PT-2012-5665 · Google · Spdy

Tomas Hoger · Published 2012-09-15 · Updated 2024-03-12 · CVE-2012-4930

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SPDY protocol versions 3 and earlier

Description The issue allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, also known as a "CRIME" attack. This is due to the SPDY protocol performing TLS encryption of compressed data without properly obfuscating the length of the unencrypted data.

Recommendations For SPDY protocol versions 3 and earlier, consider disabling the use of TLS encryption with compressed data until a proper fix is implemented to obfuscate the length of the unencrypted data.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-4930

ROSA-SA-2024-2371

Affected Products

Spdy

References · 105

• 🔥 https://github.com/mistymntncop/CVE-2023-4863 · Exploit
• 🔥 https://github.com/LiveOverflow/webp-CVE-2023-4863 · Exploit
• 🔥 https://github.com/mpgn/CRIME-poc · Exploit
• 🔥 https://github.com/wrv/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/UT-Security/cve-2023-5217-poc · Exploit
• 🔥 https://github.com/bbaranoff/CVE-2023-4863 · Exploit
• https://bdu.fstec.ru/vul/2023-05175 · Security Note
• https://bdu.fstec.ru/vul/2023-05179 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/699321 · Security Note
• https://bdu.fstec.ru/vul/2023-05102 · Security Note
• https://bdu.fstec.ru/vul/2015-06539 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4578 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4573 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/698530 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5169 · Security Note