// For flags

CVE-2012-2131

OpenSSL - ASN1 BIO Memory Corruption

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110.

Múltiples errores de signo en enteros en crypto/buffer/buffer.c en OpenSSL v0.9.8v permite a atacantes remotos realizar ataques de desbordamiento de buffer, y provocar una denegación de servicio (corrupción de memoria) o posiblemente tener otro impacto no especificado, a través de datos DER modificados, como se demuestra con un certificado X.509 o una clave pública RSA. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2012-2110.

OS X Mountain Lion version 10.8.4 and Security Update 2013-002 is now available and addresses over 30 security issues.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2012-04-04 CVE Reserved
  • 2012-04-19 First Exploit
  • 2012-04-24 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-189: Numeric Errors
CAPEC
References (22)
URL Tag Source
http://cvs.openssl.org/chngview?cn=22479 X_refsource_confirm
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673 X_refsource_confirm
http://secunia.com/advisories/48895 Third Party Advisory
http://secunia.com/advisories/48956 Third Party Advisory
http://secunia.com/advisories/57353 Third Party Advisory
http://support.apple.com/kb/HT5784 X_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 X_refsource_confirm
http://www.openwall.com/lists/oss-security/2012/04/24/1 Mailing List
http://www.securityfocus.com/bid/53212 Vdb Entry
http://www.securitytracker.com/id?1026957 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/75099 Vdb Entry
URL Date SRC
https://www.exploit-db.com/exploits/18756 2012-04-19
URL Date SRC
URL Date SRC
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html 2018-01-05
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.html 2018-01-05
http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.html 2018-01-05
http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html 2018-01-05
http://marc.info/?l=bugtraq&m=133728068926468&w=2 2018-01-05
http://marc.info/?l=bugtraq&m=134039053214295&w=2 2018-01-05
http://www.debian.org/security/2012/dsa-2454 2018-01-05
http://www.mandriva.com/security/advisories?name=MDVSA-2012:064 2018-01-05
http://www.openssl.org/news/secadv_20120424.txt 2018-01-05
http://www.ubuntu.com/usn/USN-1428-1 2018-01-05
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Openssl
Search vendor "Openssl"
 Openssl
Search vendor "Openssl" for product "Openssl"
 0.9.8v
Search vendor "Openssl" for product "Openssl" and version "0.9.8v"
-
Affected