NVD

Id
10815  
Name
CVE-2011-4354  
Description
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-07  
Published
2012-01-26  
Modified Date
2012-11-06  
Seq
2011-4354  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
60779 10815 CVE-2011-4354 http://crypto.di.uminho.pt/CACE/CT-RSA2012-openssl-src.zip  View
60780 10815 CVE-2011-4354 http://cvs.openssl.org/filediff?f=openssl/crypto/bn/bn_nist.c&v1=1.14&v2=1.21  View
60781 10815 CVE-2011-4354 http://eprint.iacr.org/2011/633  View
60782 10815 CVE-2011-4354 http://marc.info/?t=119271238800004  View
60783 10815 CVE-2011-4354 [oss-security] 20111201 CVE-2011-4354 OpenSSL 0.9.8g (32-bit builds) bug leaks ECC private keys  View
60784 10815 CVE-2011-4354 http://rt.openssl.org/Ticket/Display.html?id=1593&user=guest&pass=guest  View
60785 10815 CVE-2011-4354 DSA-2390  View
60786 10815 CVE-2011-4354 https://bugzilla.redhat.com/show_bug.cgi?id=757909  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
25517 JVNDB-2012-001224 32-bit プラットフォーム上の OpenSSL における TLS サーバの秘密鍵を取得される脆弱性 stunnel および他の製品で使用される 32-bit プラットフォーム上の OpenSSL の crypto/bn/bn_nist.c は、ECDH および ECDHE 暗号群を伴うある特定の状況で、P-256 および P-384 の NIST 楕円曲線の実装に不適切なモジュラ還元アルゴリズムを使用するため、TLS サーバの秘密鍵を取得される脆弱性が存在します。 CVE-2011-4354 52261 CVE-2011-4354 10815 5.8 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-001224.html 2012-01-15 2012-01-30 View