CVE-2012-4930: Low severity Google Chrome vulnerability
CVE-2012-4930 was assigned to the following issue:
The SPDY protocol 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
References:
http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html http://threatpost.com/enus/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 http://www.ekoparty.org/2012/thai-duong.php http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091 http://www.theregister.co.uk/2012/09/14/crimetlsattack/ https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4930?
CVE-2012-4930 is considered a moderate severity vulnerability due to its potential for man-in-the-middle attacks.
How does CVE-2012-4930 allow attackers to exploit a system?
CVE-2012-4930 allows attackers to exploit the vulnerability by observing the length of unencrypted data, revealing plaintext HTTP headers.
Which software versions are affected by CVE-2012-4930?
CVE-2012-4930 affects versions of Google Chrome and Mozilla Firefox that utilize the SPDY protocol 3 and earlier.
How do I mitigate the risks associated with CVE-2012-4930?
Mitigating risks associated with CVE-2012-4930 can involve updating affected browsers to their latest versions.
Is CVE-2012-4930 still a relevant threat today?
While CVE-2012-4930 was addressed in later browser updates, any outdated systems using affected versions may still be at risk.