CVE-2011-4576: Medium severity openssl vulnerability

Q: What is the severity of CVE-2011-4576?

CVE-2011-4576 has been rated as a moderate severity vulnerability due to the potential for sensitive information disclosure.

Q: How do I fix CVE-2011-4576?

To fix CVE-2011-4576, upgrade to a version of OpenSSL that is not affected, specifically version 0.9.8s or later or 1.0.0f or later.

Q: What are the affected versions in CVE-2011-4576?

CVE-2011-4576 affects OpenSSL versions from 0.9.1c to 0.9.8r and 1.0.0-beta1 to 1.0.0e.

Q: Can exploiting CVE-2011-4576 allow remote attacks?

Yes, exploiting CVE-2011-4576 can allow remote attackers to gain access to sensitive information by decrypting padding data.

Q: Is CVE-2011-4576 still a risk today?

As of now, CVE-2011-4576 is a risk if legacy versions of OpenSSL are still in use, especially in sensitive applications.

Published Jan 6, 2012

Updated

The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.

Affected Software

64 affected components

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.8m

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.8n

OpenSSL OpenSSL=0.9.8p

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.6h-bogus

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.8k

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.8j

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL<=0.9.8r

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.8l

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.8o

OpenSSL OpenSSL=0.9.8q

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.8i

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.8h

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL<=1.0.0e

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

Event History

Jan 6, 2012

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4576?

CVE-2011-4576 has been rated as a moderate severity vulnerability due to the potential for sensitive information disclosure.

How do I fix CVE-2011-4576?

To fix CVE-2011-4576, upgrade to a version of OpenSSL that is not affected, specifically version 0.9.8s or later or 1.0.0f or later.

What are the affected versions in CVE-2011-4576?