NVD

Id
45055  
Name
CVE-2012-3461  
Description
The (1) otrl_base64_otr_decode function in src/b64.c; (2) otrl_proto_data_read_flags and (3) otrl_proto_accept_data functions in src/proto.c; and (4) decode function in toolkit/parse.c in libotr before 3.2.1 allocates a zero-length buffer when decoding a base64 string, which allows remote attackers to cause a denial of service (application crash) via a message with the value "?OTR:===.", which triggers a heap-based buffer overflow.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-19  
Published
2012-08-20  
Modified Date
2013-08-21  
Seq
2012-3461  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
225914 45055 CVE-2012-3461 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684121  View
225915 45055 CVE-2012-3461 [OTR-dev] 20120727 otrl_base64_otr_decode() function...  View
225916 45055 CVE-2012-3461 [OTR-dev] 20120727 Re: otrl_base64_otr_decode() function...  View
225917 45055 CVE-2012-3461 openSUSE-SU-2012:1525  View
225918 45055 CVE-2012-3461 SUSE-SU-2012:1578  View
225919 45055 CVE-2012-3461 openSUSE-SU-2013:0155  View
225920 45055 CVE-2012-3461 http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=1902baee5d4b056850274ed0fa8c2409f1187435  View
225921 45055 CVE-2012-3461 http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=6d4ca89cf1d3c9a8aff696c3a846ac5a51f762c1  View
225922 45055 CVE-2012-3461 http://otr.git.sourceforge.net/git/gitweb.cgi?p=otr/libotr;a=commitdiff;h=b17232f86f8e60d0d22caf9a2400494d3c77da58  View
225923 45055 CVE-2012-3461 DSA-2526  View
225924 45055 CVE-2012-3461 MDVSA-2012:131  View
225925 45055 CVE-2012-3461 MDVSA-2013:097  View
225926 45055 CVE-2012-3461 54907  View
225927 45055 CVE-2012-3461 USN-1541-1  View
225928 45055 CVE-2012-3461 libotr-base64-bo(77528)  View
225929 45055 CVE-2012-3461 https://bugzilla.redhat.com/show_bug.cgi?id=846377  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
28070 JVNDB-2012-003777 libotr におけるサービス運用妨害 (アプリケーションクラッシュ) の脆弱性 libotr の下記の関数は、base64 の文字列をデコードする際、長さゼロのバッファを割り当てるため、サービス運用妨害 (アプリケーションクラッシュ) 状態となる脆弱性が存在します。 CVE-2012-3461 56699 CVE-2012-3461 45055 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-003777.html 2012-08-20 2012-10-23 View