| Vulnerability Name: | CVE-2012-4930 (CCN-78804) | ||||||||
| Assigned: | 2012-09-15 | ||||||||
| Published: | 2012-09-15 | ||||||||
| Updated: | 2013-01-30 | ||||||||
| Summary: | The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack. | ||||||||
| CVSS v3 Severity: | 3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 2.6 Low (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N) 1.9 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
1.9 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-310 | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MISC Type: UNKNOWN http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ Source: MITRE Type: CNA CVE-2012-4930 Source: CCN Type: iSEC Partners Web site Details on the CRIME attack Source: MISC Type: UNKNOWN http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html Source: SUSE Type: UNKNOWN SUSE-SU-2012:1351 Source: MISC Type: UNKNOWN http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 Source: MISC Type: UNKNOWN http://www.ekoparty.org/2012/thai-duong.php Source: CCN Type: Google Web site Google Chrome Source: MISC Type: UNKNOWN http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091 Source: CCN Type: Mozilla Web site Firefox - Rediscover the web Source: CCN Type: BID-55857 Mozilla Firefox/SeaMonkey CVE-2012-3977 Information Disclosure Vulnerability Source: MISC Type: UNKNOWN http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ Source: CCN Type: Red Hat Bugzilla Bug 857737 CVE-2012-4930 SPDY: SSL/TLS CRIME attack Source: MISC Type: UNKNOWN https://bugzilla.redhat.com/show_bug.cgi?id=857737 Source: MISC Type: UNKNOWN https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls Source: XF Type: UNKNOWN spdy-tls-info-disc(78804) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||