Vulnerability Description
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | 1.0.0 |
| Redhat | Openssl | 0.9.6-15 |
Related Weaknesses (CWE)
References
- http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.htmlExploit
- http://cvs.openssl.org/chngview?cn=22431
- http://cvs.openssl.org/chngview?cn=22434
- http://cvs.openssl.org/chngview?cn=22439
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.h
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html
- http://marc.info/?l=bugtraq&m=133728068926468&w=2
- http://marc.info/?l=bugtraq&m=133951357207000&w=2
- http://marc.info/?l=bugtraq&m=134039053214295&w=2
FAQ
What is CVE-2012-2110?
CVE-2012-2110 is a vulnerability with a CVSS score of 7.5 (HIGH). The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers ...
How severe is CVE-2012-2110?
CVE-2012-2110 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-2110?
Check the references section above for vendor advisories and patch information. Affected products include: Openssl Openssl, Redhat Openssl.