CVE-2011-1473

Published Jun 16, 2012

Last updated 3 months ago

Overview

Description: OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment
Source: cve@mitre.org
NVD status: Modified
CNA Tags: disputed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

nvd@nist.gov: CWE-264

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8m:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3C9BF2DD-85EF-49CF-8D83-0DB46449E333"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8m:beta1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6AEBE689-3952-46F0-BACA-BB03041C6D36"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8n:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "86C46AB8-52E5-4385-9C5C-F63FF9DB82AA"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8o:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "564AA4E7-223E-48D8-B3E0-A461969CF530"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8p:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A82CFB41-BEA5-4B5F-BCAA-9BAED22EEAF0"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8r:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EB15C1F3-0DE8-4A50-B17C-618ECA58AABF"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8s:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "45491BD3-7C62-4422-B7DA-CB2741890FBA"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8t:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "499E52F3-4B34-4C47-8ABF-292928EBAA5F"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8u:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D530BE19-ADCF-4B5C-99E0-2B9A1DE7717F"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8v:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A7540155-3629-4C76-9C67-8A8E0C1067F1"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8w:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "419BBCCD-6F8A-418A-BA02-56267B11D948"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8x:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8A3A2AF8-C7DD-43D0-B03F-37E7EB735C1D"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EB35F63F-7856-42EE-87A6-7EC7F10C2032",
            "versionEndIncluding": "0.9.8k"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References