NVD

Id
46190  
Name
CVE-2012-4930  
Description
The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.  
Reject
 
CVSS Version
2  
CVSS Score
2.6  
Severity
Low  
CVSS Base Score
2.6  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2012-09-15  
Modified Date
2013-01-29  
Seq
2012-4930  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
231678 46190 CVE-2012-4930 http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/  View
231679 46190 CVE-2012-4930 http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html  View
231680 46190 CVE-2012-4930 SUSE-SU-2012:1351  View
231681 46190 CVE-2012-4930 http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312  View
231682 46190 CVE-2012-4930 http://www.ekoparty.org/2012/thai-duong.php  View
231683 46190 CVE-2012-4930 http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091  View
231684 46190 CVE-2012-4930 http://www.theregister.co.uk/2012/09/14/crime_tls_attack/  View
231685 46190 CVE-2012-4930 https://bugzilla.redhat.com/show_bug.cgi?id=857737  View
231686 46190 CVE-2012-4930 https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
28687 JVNDB-2012-004394 複数の製品で使用される SPDY プロトコルにおける平文の HTTP ヘッダを取得される脆弱性 Mozilla Firefox、Google Chrome、およびその他の製品で使用される SPDY プロトコルは暗号化されていないデータの長さを分からなくすることなく、圧縮されたデータを TLS 暗号化できるため、平文の HTTP ヘッダを取得される脆弱性が存在します。 CVE-2012-4930 58168 CVE-2012-4930 46190 2.6 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004394.html 2012-09-15 2012-12-28 View