CVE-2011-4576

Published: Jan 6, 2012Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

Affected (64)

Products: Openssl: Openssl

1 product

Configuration A

53 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8r
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6h bogus
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.7m
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q

Configuration B

11 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 1.0.0e
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d

Related CWEs

References (44)

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc

Source: secalert@redhat.com

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=132750648501816&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: secalert@redhat.com

http://secunia.com/advisories/48528

Source: secalert@redhat.com

http://secunia.com/advisories/55069

Source: secalert@redhat.com

http://secunia.com/advisories/57353

Source: secalert@redhat.com

http://support.apple.com/kb/HT5784

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2390

Source: secalert@redhat.com

http://www.kb.cert.org/vuls/id/737740

Source: secalert@redhat.com

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2012:006

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2012:007

Source: secalert@redhat.com

http://www.openssl.org/news/secadv_20120104.txt

Source: secalert@redhat.com

Vendor Advisory

http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc

Source: af854a3a-2127-422b-91ae-364da2661108

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=132750648501816&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/48528

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/55069

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/57353

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT5784

Source: af854a3a-2127-422b-91ae-364da2661108

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2012/dsa-2390

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.kb.cert.org/vuls/id/737740

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2012:006

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mandriva.com/security/advisories?name=MDVSA-2012:007

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openssl.org/news/secadv_20120104.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.