CVE-2012-4555: Null Pointer Dereference
First published: Wed Oct 24 2012(Updated: )
A denial of service flaw was found in the way token processing system of Certificate System processed interrupted token format operations. A local attacker, via suddenly interrupting the token format operation, could use this flaw to cause pki-tps infrastructure to crash with NULL pointer dereference, subsequently leading to relevant Apache httpd web server worker it to need to restart, rendering it to be unavailable for short period of time possibly halting (already) in-progress operations of other users.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Certificate System | <=8.1.1 | |
| Red Hat Certificate System | =7.1 | |
| Red Hat Certificate System | =7.2 | |
| Red Hat Certificate System | =7.3 | |
| Red Hat Certificate System | =8 | |
| Red Hat Certificate System | =8.0 | |
| Red Hat Certificate System | =8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://rhn.redhat.com/errata/RHSA-2012-1550.html
- http://secunia.com/advisories/51482
- http://www.securityfocus.com/bid/56843
- http://www.securitytracker.com/id?1027846
- https://bugzilla.redhat.com/show_bug.cgi?id=869570
- https://access.redhat.com/security/cve/CVE-2012-4555
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=884830
- https://rhn.redhat.com/errata/RHSA-2012-1550.html
Frequently Asked Questions
What is the severity of CVE-2012-4555?
CVE-2012-4555 is classified as a denial of service vulnerability.
How do I fix CVE-2012-4555?
To fix CVE-2012-4555, update the Red Hat Certificate System to the latest patched version.
Which versions of Red Hat Certificate System are affected by CVE-2012-4555?
CVE-2012-4555 affects Red Hat Certificate System versions up to and including 8.1.1, and 7.1, 7.2, and 7.3 specifically.
Can CVE-2012-4555 be exploited remotely?
CVE-2012-4555 requires local access to exploit, making it a local denial of service attack.
What are the potential impacts of CVE-2012-4555?
Exploitation of CVE-2012-4555 could lead to crashes of the pki-tps infrastructure due to NULL pointer dereference.
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-4555
- agent/severity
- agent/references
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat certificate system
- version/red hat certificate system/8.1.1
- version/red hat certificate system/7.1
- version/red hat certificate system/7.2
- version/red hat certificate system/7.3
- version/red hat certificate system/8
- version/red hat certificate system/8.0
- version/red hat certificate system/8.1