CVE-2011-4108

Severity

43%

Complexity

86%

Confidentiality

48%

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N).

Overview

First reported 13 years ago

2012-01-06 01:55:00

Last updated 8 years ago

2016-08-23 02:04:00

Affected Software

OpenSSL Project OpenSSL 0.9.1c

0.9.1c

OpenSSL Project OpenSSL 0.9.2b

0.9.2b

OpenSSL Project OpenSSL 0.9.4

0.9.4

OpenSSL Project OpenSSL 0.9.5

0.9.5

OpenSSL Project OpenSSL 0.9.5a

0.9.5a

OpenSSL Project OpenSSL 0.9.6

0.9.6

OpenSSL Project OpenSSL 0.9.6a

0.9.6a

OpenSSL Project OpenSSL 0.9.6b

0.9.6b

OpenSSL Project OpenSSL 0.9.6c

0.9.6c

OpenSSL Project OpenSSL 0.9.6d

0.9.6d

OpenSSL Project OpenSSL 0.9.6e

0.9.6e

OpenSSL Project OpenSSL 0.9.6f

0.9.6f

OpenSSL Project OpenSSL 0.9.6g

0.9.6g

OpenSSL Project OpenSSL 0.9.6h

0.9.6h

OpenSSL Project OpenSSL 0.9.6i

0.9.6i

OpenSSL Project OpenSSL 0.9.6j

0.9.6j

OpenSSL Project OpenSSL 0.9.6k

0.9.6k

OpenSSL Project OpenSSL 0.9.6l

0.9.6l

OpenSSL Project OpenSSL 0.9.6m

0.9.6m

OpenSSL Project OpenSSL 0.9.7

0.9.7

OpenSSL Project OpenSSL 0.9.7a

0.9.7a

OpenSSL Project OpenSSL 0.9.7b

0.9.7b

OpenSSL Project OpenSSL 0.9.7c

0.9.7c

OpenSSL Project OpenSSL 0.9.7d

0.9.7d

OpenSSL Project OpenSSL 0.9.7e

0.9.7e

OpenSSL Project OpenSSL 0.9.7f

0.9.7f

OpenSSL Project OpenSSL 0.9.7g

0.9.7g

OpenSSL Project OpenSSL 0.9.7h

0.9.7h

OpenSSL Project OpenSSL 0.9.7i

0.9.7i

OpenSSL Project OpenSSL 0.9.7j

0.9.7j

OpenSSL Project OpenSSL 0.9.7k

0.9.7k

OpenSSL Project OpenSSL 0.9.7l

0.9.7l

OpenSSL Project OpenSSL 0.9.7m

0.9.7m

OpenSSL Project OpenSSL 0.9.8

0.9.8

OpenSSL Project OpenSSL 0.9.8a

0.9.8a

OpenSSL Project OpenSSL 0.9.8b

0.9.8b

OpenSSL Project OpenSSL 0.9.8c

0.9.8c

OpenSSL Project OpenSSL 0.9.8d

0.9.8d

OpenSSL Project OpenSSL 0.9.8e

0.9.8e

OpenSSL Project OpenSSL 0.9.8f

0.9.8f

OpenSSL Project OpenSSL 0.9.8g

0.9.8g

OpenSSL Project OpenSSL 0.9.8h

0.9.8h

OpenSSL Project OpenSSL 0.9.8i

0.9.8i

OpenSSL Project OpenSSL 0.9.8j

0.9.8j

OpenSSL Project OpenSSL 0.9.8k

0.9.8k

OpenSSL Project OpenSSL 0.9.8l

0.9.8l

OpenSSL Project OpenSSL 0.9.8m

0.9.8m

OpenSSL Project OpenSSL 0.9.8n

0.9.8n

OpenSSL Project OpenSSL 0.9.8o

0.9.8o

OpenSSL Project OpenSSL 0.9.8p

0.9.8p

OpenSSL Project OpenSSL 0.9.8q

0.9.8q

OpenSSL Project OpenSSL

OpenSSL Project OpenSSL 1.0.0

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta1

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta2

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta3

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta4

1.0.0

OpenSSL Project OpenSSL 1.0.0 Beta5

1.0.0

OpenSSL Project OpenSSL 1.0.0a

1.0.0a

OpenSSL Project OpenSSL 1.0.0b

1.0.0b

OpenSSL Project OpenSSL 1.0.0c

1.0.0c

OpenSSL Project OpenSSL 1.0.0d

1.0.0d

References

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc

HPSBMU02786

APPLE-SA-2013-06-04-1

FEDORA-2012-18035

openSUSE-SU-2012:0083

SUSE-SU-2012:0084

SUSE-SU-2014:0320

HPSBUX02734

SSRT100852

HPSBOV02793

RHSA-2012:1306

RHSA-2012:1307

RHSA-2012:1308

48528

57260

57353

http://support.apple.com/kb/HT5784

DSA-2390

http://www.isg.rhul.ac.uk/~kp/dtls.pdf

VU#737740

US Government Resource

MDVSA-2012:006

MDVSA-2012:007

http://www.openssl.org/news/secadv_20120104.txt

Vendor Advisory

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

https://security.paloaltonetworks.com/CVE-2011-4108

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.