|
|
|
|
| |
Credit:
The information has been provided by Ivan Nestlerode.
The original article can be found at: http://www.openssl.org/news/secadv_20120312.txt
|
| |
Vulnerable Systems:
* Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h
A weakness in the OpenSSL CMS and PKCS #7 code can be exploited
using Bleichenbacher's attack on PKCS #1 v1.5 RSA padding
also known as the million message attack (MMA).
Only users of CMS, PKCS #7, or S/MIME decryption operations are affected. A
successful attack needs on average 2^20 messages. In practice only automated
systems will be affected as humans will not be willing to process this many
messages.
SSL/TLS applications are *NOT* affected by this problem since the
SSL/TLS code does not use the PKCS#7 or CMS decryption code.
Vendor Status:
OpenSSL core team had issued an update for this vulnerability
Patch Availability:
http://www.openssl.org//source/
CVE Information:
CVE-2012-0884
Disclosure Timeline:
Initial Release : 12 Mar 2012
|
|
|
|
|
