NVD

Id
46189  
Name
CVE-2012-4929  
Description
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-09-15  
Modified Date
2016-08-22  
Seq
2012-4929  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
231645 46189 CVE-2012-4929 http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/  View
231646 46189 CVE-2012-4929 http://code.google.com/p/chromium/issues/detail?id=139744  View
231647 46189 CVE-2012-4929 http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html  View
231648 46189 CVE-2012-4929 JVN#65273415  View
231649 46189 CVE-2012-4929 JVNDB-2016-000129  View
231650 46189 CVE-2012-4929 APPLE-SA-2013-06-04-1  View
231651 46189 CVE-2012-4929 FEDORA-2013-4403  View
231652 46189 CVE-2012-4929 openSUSE-SU-2012:1420  View
231653 46189 CVE-2012-4929 openSUSE-SU-2013:0143  View
231654 46189 CVE-2012-4929 openSUSE-SU-2013:0157  View
231655 46189 CVE-2012-4929 SSRT101139  View
231656 46189 CVE-2012-4929 http://news.ycombinator.com/item?id=4510829  View
231657 46189 CVE-2012-4929 oval:org.mitre.oval:def:18920  View
231658 46189 CVE-2012-4929 RHSA-2013:0587  View
231659 46189 CVE-2012-4929 http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor  View
231660 46189 CVE-2012-4929 http://support.apple.com/kb/HT5784  View
231661 46189 CVE-2012-4929 http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312  View
231662 46189 CVE-2012-4929 http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512  View
231663 46189 CVE-2012-4929 DSA-2579  View
231664 46189 CVE-2012-4929 DSA-2627  View
231665 46189 CVE-2012-4929 DSA-3253  View
231666 46189 CVE-2012-4929 http://www.ekoparty.org/2012/thai-duong.php  View
231667 46189 CVE-2012-4929 http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091  View
231668 46189 CVE-2012-4929 55704  View
231669 46189 CVE-2012-4929 http://www.theregister.co.uk/2012/09/14/crime_tls_attack/  View
231670 46189 CVE-2012-4929 USN-1627-1  View
231671 46189 CVE-2012-4929 USN-1628-1  View
231672 46189 CVE-2012-4929 USN-1898-1  View
231673 46189 CVE-2012-4929 https://bugzilla.redhat.com/show_bug.cgi?id=857051  View
231674 46189 CVE-2012-4929 https://chromiumcodereview.appspot.com/10825183  View
231675 46189 CVE-2012-4929 https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls  View
231676 46189 CVE-2012-4929 https://gist.github.com/3696912  View
231677 46189 CVE-2012-4929 https://threatpost.com/en_us/blogs/demo-crime-tls-attack-091212  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
125 JVNDB-2016-000129 Android OS が CRIME 攻撃による影響を受けてしまう問題 Android OS での TLS プロトコルの実装には、平文の HTTP ヘッダを取得されてしまう脆弱性が存在します。 CVE-2012-4929 58167 CVE-2012-4929 46189 2.6 3.7 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-000129.html 2016-07-22 2016-07-22 View
28686 JVNDB-2012-004393 複数の製品で使用される TLS プロトコルにおける平文の HTTP ヘッダを取得される脆弱性 Mozilla Firefox、Google Chrome、Qt、およびその他の製品で使用される TLS プロトコルは、暗号化されていないデータの長さを分からなくすることなく、圧縮されたデータを暗号化することができるため、平文の HTTP ヘッダを取得される脆弱性が存在します。 CVE-2012-4929 58167 CVE-2012-4929 46189 2.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004393.html 2012-09-15 2015-08-13 View