FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2011-4108

This CVE name corresponds to:

Entered Topic
2012-01-14 OpenSSL -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2011-4108
Phase Assigned(20111018)

Description

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

References

Source Reference
MISC http://www.isg.rhul.ac.uk/~kp/dtls.pdf
CONFIRM http://www.openssl.org/news/secadv_20120104.txt
CONFIRM http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
CONFIRM http://support.apple.com/kb/HT5784
CONFIRM https://securityadvisories.paloaltonetworks.com/Home/Detail/17
CONFIRM http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
APPLE APPLE-SA-2013-06-04-1
DEBIAN DSA-2390
FEDORA FEDORA-2012-18035
HP HPSBMU02786
HP SSRT100877
HP HPSBOV02793
HP SSRT100891
HP HPSBUX02734
HP SSRT100729
MANDRIVA MDVSA-2012:006
MANDRIVA MDVSA-2012:007
REDHAT RHSA-2012:1306
REDHAT RHSA-2012:1307
REDHAT RHSA-2012:1308
SUSE SUSE-SU-2012:0084
SUSE openSUSE-SU-2012:0083
SUSE SUSE-SU-2014:0320
CERT-VN VU#737740
SECUNIA 48528
SECUNIA 57260
SECUNIA 57353