NVD

Id
15526  
Name
CVE-2010-4252  
Description
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-12-06  
Modified Date
2016-08-22  
Seq
2010-4252  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
87777 15526 CVE-2010-4252 http://cvs.openssl.org/chngview?cn=20098  View
87778 15526 CVE-2010-4252 SSRT100339  View
87779 15526 CVE-2010-4252 SSRT100475  View
87780 15526 CVE-2010-4252 http://openssl.org/news/secadv_20101202.txt  View
87781 15526 CVE-2010-4252 oval:org.mitre.oval:def:19039  View
87782 15526 CVE-2010-4252 http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf  View
87783 15526 CVE-2010-4252 1024823  View
87784 15526 CVE-2010-4252 SSA:2010-340-01  View
87785 15526 CVE-2010-4252 http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564  View
87786 15526 CVE-2010-4252 45163  View
87787 15526 CVE-2010-4252 ADV-2010-3120  View
87788 15526 CVE-2010-4252 ADV-2010-3122  View
87789 15526 CVE-2010-4252 https://bugzilla.redhat.com/show_bug.cgi?id=659297  View
87790 15526 CVE-2010-4252 https://github.com/seb-m/jpake  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36769 JVNDB-2010-002549 OpenSSL における共有秘密鍵の認証要求を回避される脆弱性 OpenSSL は、J-PAKE が有効な際、J-PAKE プロトコル内のパブリックパラメータを適切に認証しないため、共有秘密鍵の認証要求を回避される脆弱性が存在します。 CVE-2010-4252 46832 CVE-2010-4252 15526 7.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002549.html 2010-11-29 2012-11-02 View