CVE-2012-4555: Null Pointer Dereference
A denial of service flaw was found in the way token processing system of Certificate System processed interrupted token format operations. A local attacker, via suddenly interrupting the token format operation, could use this flaw to cause pki-tps infrastructure to crash with NULL pointer dereference, subsequently leading to relevant Apache httpd web server worker it to need to restart, rendering it to be unavailable for short period of time possibly halting (already) in-progress operations of other users.
Other sources
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4555?
CVE-2012-4555 is classified as a denial of service vulnerability.
How do I fix CVE-2012-4555?
To fix CVE-2012-4555, update the Red Hat Certificate System to the latest patched version.
Which versions of Red Hat Certificate System are affected by CVE-2012-4555?
CVE-2012-4555 affects Red Hat Certificate System versions up to and including 8.1.1, and 7.1, 7.2, and 7.3 specifically.
Can CVE-2012-4555 be exploited remotely?
CVE-2012-4555 requires local access to exploit, making it a local denial of service attack.
What are the potential impacts of CVE-2012-4555?
Exploitation of CVE-2012-4555 could lead to crashes of the pki-tps infrastructure due to NULL pointer dereference.