CVE-2011-4108

Published: Jan 6, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

Affected (64)

Products: Openssl: Openssl

1 product

Configuration A

53 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8r
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6h bogus
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.7m
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 1.0.0e
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d

Related CWEs

References (50)

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=132750648501816&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: secalert@redhat.com

http://secunia.com/advisories/48528

Source: secalert@redhat.com

http://secunia.com/advisories/57260

Source: secalert@redhat.com

http://secunia.com/advisories/57353

Source: secalert@redhat.com

http://support.apple.com/kb/HT5784

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2390

Source: secalert@redhat.com

http://www.isg.rhul.ac.uk/~kp/dtls.pdf

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/737740

Source: secalert@redhat.com

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2012:006

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2012:007

Source: secalert@redhat.com

http://www.openssl.org/news/secadv_20120104.txt

Source: secalert@redhat.com

Vendor Advisory

https://security.paloaltonetworks.com/CVE-2011-4108

Source: secalert@redhat.com

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc

Source: af854a3a-2127-422b-91ae-364da2661108

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=132750648501816&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48528

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57260

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57353

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5784

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2012/dsa-2390

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.isg.rhul.ac.uk/~kp/dtls.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/737740

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2012:006

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2012:007

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openssl.org/news/secadv_20120104.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://security.paloaltonetworks.com/CVE-2011-4108

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.