CVEvulnerability
CVE-2012-4929
2.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2012-09-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
Affected configurations
• debian debian linux 7.0
• debian debian linux 8.0
• google chrome
• mozilla firefox
Related
Weakness · not in database (1)
References
- http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ arstechnica.com
- http://code.google.com/p/chromium/issues/detail?id=139744 code.google.com
- http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html isecpartners.com
- http://jvn.jp/en/jp/JVN65273415/index.html jvn.jp
- http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000129.html jvndb.jvn.jp
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html lists.apple.com
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00096.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=136612293908376&w=2 marc.info
- http://news.ycombinator.com/item?id=4510829 news.ycombinator.com
- http://rhn.redhat.com/errata/RHSA-2013-0587.html rhn.redhat.com
- http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor security.stackexchange.com
- http://support.apple.com/kb/HT5784 support.apple.com
- http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 threatpost.com
- http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512 threatpost.com
- http://www.debian.org/security/2012/dsa-2579 www.debian.org
- http://www.debian.org/security/2013/dsa-2627 www.debian.org
- http://www.debian.org/security/2015/dsa-3253 www.debian.org
- http://www.ekoparty.org/2012/thai-duong.php www.ekoparty.org
- http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091 www.iacr.org
- http://www.securityfocus.com/bid/55704 www.securityfocus.com
- http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ www.theregister.co.uk
- http://www.ubuntu.com/usn/USN-1627-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1628-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1898-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=857051 bugzilla.redhat.com
- https://chromiumcodereview.appspot.com/10825183 chromiumcodereview.appspot.com
- https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls community.qualys.com
- https://gist.github.com/3696912 gist.github.com
- https://github.com/mpgn/CRIME-poc github.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18920 oval.cisecurity.org
- https://threatpost.com/en_us/blogs/demo-crime-tls-attack-091212 threatpost.com
- http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ arstechnica.com
- http://code.google.com/p/chromium/issues/detail?id=139744 code.google.com
- http://isecpartners.com/blog/2012/9/14/details-on-the-crime-attack.html isecpartners.com
- http://jvn.jp/en/jp/JVN65273415/index.html jvn.jp
- http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000129.html jvndb.jvn.jp
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html lists.apple.com
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101366.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00096.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00034.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-updates/2013-01/msg00048.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=136612293908376&w=2 marc.info
- http://news.ycombinator.com/item?id=4510829 news.ycombinator.com
- http://rhn.redhat.com/errata/RHSA-2013-0587.html rhn.redhat.com
- http://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor security.stackexchange.com
- http://support.apple.com/kb/HT5784 support.apple.com
- http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 threatpost.com
- http://threatpost.com/en_us/blogs/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512 threatpost.com
- http://www.debian.org/security/2012/dsa-2579 www.debian.org
- http://www.debian.org/security/2013/dsa-2627 www.debian.org
- http://www.debian.org/security/2015/dsa-3253 www.debian.org
- http://www.ekoparty.org/2012/thai-duong.php www.ekoparty.org
- http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091 www.iacr.org
- http://www.securityfocus.com/bid/55704 www.securityfocus.com
- http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ www.theregister.co.uk
- http://www.ubuntu.com/usn/USN-1627-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1628-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-1898-1 www.ubuntu.com
- https://bugzilla.redhat.com/show_bug.cgi?id=857051 bugzilla.redhat.com
- https://chromiumcodereview.appspot.com/10825183 chromiumcodereview.appspot.com
- https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls community.qualys.com
- https://gist.github.com/3696912 gist.github.com
- https://github.com/mpgn/CRIME-poc github.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18920 oval.cisecurity.org
- https://threatpost.com/en_us/blogs/demo-crime-tls-attack-091212 threatpost.com