CVE-2011-4108: Medium severity openssl vulnerability

Q: What is the severity of CVE-2011-4108?

CVE-2011-4108 is categorized as a high severity vulnerability due to its potential to allow remote attackers to recover plaintext data.

Q: How do I fix CVE-2011-4108?

To mitigate CVE-2011-4108, update OpenSSL to versions 0.9.8s or 1.0.0f or later, which contain the security fix.

Q: What systems are affected by CVE-2011-4108?

CVE-2011-4108 affects various OpenSSL versions including 0.9.8b through 0.9.8r and 1.0.0beta1 through 1.0.0e.

Q: How does CVE-2011-4108 work?

CVE-2011-4108 exploits a padding oracle attack that can bypass MAC checks, enabling plaintext recovery.

Q: Is CVE-2011-4108 still relevant today?

CVE-2011-4108 remains relevant for systems still running affected OpenSSL versions, emphasizing the need for regular updates.

Published Jan 6, 2012

Updated

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

Affected Software

64 affected components

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.6h-bogus

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL<=0.9.8r

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=0.9.8q

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL<=1.0.0e

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

Event History

Jan 6, 2012

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4108?

CVE-2011-4108 is categorized as a high severity vulnerability due to its potential to allow remote attackers to recover plaintext data.

How do I fix CVE-2011-4108?

To mitigate CVE-2011-4108, update OpenSSL to versions 0.9.8s or 1.0.0f or later, which contain the security fix.

What systems are affected by CVE-2011-4108?