CVE-2012-2686: Medium severity OpenSSL OpenSSL vulnerability
A flaw in the OpenSSL handling of CBC ciphersuites in TLS 1.1 and TLS 1.2 on AES-NI (Advanced Encryption Standard New Instructions) supporting platforms [1] can be exploited in a DoS attack.
Anyone using an AES-NI platform for TLS 1.2 or TLS 1.1 on OpenSSL 1.0.1c is affected. Platforms which do not support AES-NI or versions of OpenSSL which do not implement TLS 1.2 or 1.1 (for example OpenSSL 0.9.8 and 1.0.0) are not affected.
[1] http://en.wikipedia.org/wiki/AES-NI#SupportingCPUs
External References:
http://www.openssl.org/news/secadv20130205.txt
Other sources
crypto/evp/eaescbchmacsha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2686?
CVE-2012-2686 is considered to have a moderate severity due to its potential for exploitation in a denial of service (DoS) attack.
How do I fix CVE-2012-2686?
To fix CVE-2012-2686, upgrade OpenSSL to version 1.0.1e or later, which addresses the vulnerability.
What platforms are affected by CVE-2012-2686?
CVE-2012-2686 affects platforms using TLS 1.1 and TLS 1.2 with OpenSSL versions 1.0.1, 1.0.1a, 1.0.1b, and 1.0.1c on AES-NI supported systems.
What type of attack can exploit CVE-2012-2686?
CVE-2012-2686 can be exploited to conduct a denial of service (DoS) attack against affected systems.
Is my software safe from CVE-2012-2686 if I am not using TLS 1.1 or TLS 1.2?
If you are not using TLS 1.1 or TLS 1.2 with the affected versions of OpenSSL, your software should be safe from CVE-2012-2686.