CVE-2012-2110

Published: Apr 19, 2012Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.

Affected (91)

Products: Openssl: Openssl · Redhat: Openssl

1 product

1 product

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.0
Openssl Openssl	Version 1.0.0 beta1
Openssl Openssl	Version 1.0.0 beta2
Openssl Openssl	Version 1.0.0 beta3
Openssl Openssl	Version 1.0.0 beta4
Openssl Openssl	Version 1.0.0 beta5
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0g

Configuration B

77 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8u
Openssl Openssl	Version 0.9.1c
Openssl Openssl	Version 0.9.2b
Openssl Openssl	Version 0.9.3
Openssl Openssl	Version 0.9.3a
Openssl Openssl	Version 0.9.4
Openssl Openssl	Version 0.9.5
Openssl Openssl	Version 0.9.5 beta1
Openssl Openssl	Version 0.9.5 beta2
Openssl Openssl	Version 0.9.5a
Openssl Openssl	Version 0.9.5a beta1
Openssl Openssl	Version 0.9.5a beta2
Openssl Openssl	Version 0.9.6
Openssl Openssl	Version 0.9.6 beta1
Openssl Openssl	Version 0.9.6 beta2
Openssl Openssl	Version 0.9.6 beta3
Openssl Openssl	Version 0.9.6a
Openssl Openssl	Version 0.9.6a beta1
Openssl Openssl	Version 0.9.6a beta2
Openssl Openssl	Version 0.9.6a beta3
Openssl Openssl	Version 0.9.6b
Openssl Openssl	Version 0.9.6c
Openssl Openssl	Version 0.9.6d
Openssl Openssl	Version 0.9.6e
Openssl Openssl	Version 0.9.6f
Openssl Openssl	Version 0.9.6g
Openssl Openssl	Version 0.9.6h
Openssl Openssl	Version 0.9.6i
Openssl Openssl	Version 0.9.6j
Openssl Openssl	Version 0.9.6k
Openssl Openssl	Version 0.9.6l
Openssl Openssl	Version 0.9.6m
Openssl Openssl	Version 0.9.7
Openssl Openssl	Version 0.9.7 beta1
Openssl Openssl	Version 0.9.7 beta2
Openssl Openssl	Version 0.9.7 beta3
Openssl Openssl	Version 0.9.7 beta4
Openssl Openssl	Version 0.9.7 beta5
Openssl Openssl	Version 0.9.7 beta6
Openssl Openssl	Version 0.9.7a
Openssl Openssl	Version 0.9.7b
Openssl Openssl	Version 0.9.7c
Openssl Openssl	Version 0.9.7d
Openssl Openssl	Version 0.9.7e
Openssl Openssl	Version 0.9.7f
Openssl Openssl	Version 0.9.7g
Openssl Openssl	Version 0.9.7h
Openssl Openssl	Version 0.9.7i
Openssl Openssl	Version 0.9.7j
Openssl Openssl	Version 0.9.7k
Openssl Openssl	Version 0.9.7l
Openssl Openssl	Version 0.9.7m
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 0.9.8a
Openssl Openssl	Version 0.9.8b
Openssl Openssl	Version 0.9.8c
Openssl Openssl	Version 0.9.8d
Openssl Openssl	Version 0.9.8e
Openssl Openssl	Version 0.9.8f
Openssl Openssl	Version 0.9.8g
Openssl Openssl	Version 0.9.8h
Openssl Openssl	Version 0.9.8i
Openssl Openssl	Version 0.9.8j
Openssl Openssl	Version 0.9.8k
Openssl Openssl	Version 0.9.8l
Openssl Openssl	Version 0.9.8m
Openssl Openssl	Version 0.9.8m beta1
Openssl Openssl	Version 0.9.8n
Openssl Openssl	Version 0.9.8o
Openssl Openssl	Version 0.9.8p
Openssl Openssl	Version 0.9.8q
Openssl Openssl	Version 0.9.8r
Openssl Openssl	Version 0.9.8s
Openssl Openssl	Version 0.9.8t
Redhat Openssl	Version 0.9.6-15
Redhat Openssl	Version 0.9.6b-3
Redhat Openssl	Version 0.9.7a-2

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.1 beta1
Openssl Openssl	Version 1.0.1 beta2

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (78)

http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html

Source: secalert@redhat.com

Exploit

http://cvs.openssl.org/chngview?cn=22431

Source: secalert@redhat.com

http://cvs.openssl.org/chngview?cn=22434

Source: secalert@redhat.com

http://cvs.openssl.org/chngview?cn=22439

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133728068926468&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Source: secalert@redhat.com

http://osvdb.org/81223

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0518.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-0522.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Source: secalert@redhat.com

http://secunia.com/advisories/48847

Source: secalert@redhat.com

http://secunia.com/advisories/48895

Source: secalert@redhat.com

http://secunia.com/advisories/48899

Source: secalert@redhat.com

http://secunia.com/advisories/48942

Source: secalert@redhat.com

http://secunia.com/advisories/48999

Source: secalert@redhat.com

http://secunia.com/advisories/57353

Source: secalert@redhat.com

http://support.apple.com/kb/HT5784

Source: secalert@redhat.com

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Source: secalert@redhat.com

http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578

Source: secalert@redhat.com

http://www.debian.org/security/2012/dsa-2454

Source: secalert@redhat.com

http://www.exploit-db.com/exploits/18756

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2012:060

Source: secalert@redhat.com

http://www.openssl.org/news/secadv_20120419.txt

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/bid/53158

Source: secalert@redhat.com

http://www.securitytracker.com/id?1026957

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1424-1

Source: secalert@redhat.com

https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862

Source: secalert@redhat.com

https://kb.juniper.net/KB27376

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html