CVE-2012-4929: Low severity Debian Debian Linux vulnerability
Juliano Rizzo and Thai Duong, researches that reported BEAST (Browser Exploit Against SSL/TLS, bug #737506) attack announced they are planning to disclose another attack against SSL/TLS named CRIME. The issue is planned to be presented by them on the ekoparty 2012 conference.
http://www.ekoparty.org/2012/juliano-rizzo.php http://www.ekoparty.org/2012/thai-duong.php http://www.h-online.com/security/news/item/BEAST-creators-develop-new-SSL-attack-1702136.html http://threatpost.com/enus/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512
Other sources
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4929?
CVE-2012-4929 is considered a medium to high severity vulnerability that can lead to man-in-the-middle attacks.
How can I fix CVE-2012-4929?
To fix CVE-2012-4929, update affected software such as Mozilla Firefox and Google Chrome to the latest versions.
Which versions of software are affected by CVE-2012-4929?
CVE-2012-4929 affects TLS protocol 1.2 and earlier versions in browsers like Firefox, Chrome, and operating systems like Debian 7.0 and 8.0.
What type of attack does CVE-2012-4929 enable?
CVE-2012-4929 enables man-in-the-middle attackers to exploit vulnerabilities in TLS compression to obtain plaintext HTTP headers.
Is CVE-2012-4929 still a threat today?
While CVE-2012-4929 has been addressed in later software versions, it may still pose a threat for users operating outdated versions of affected software.