製品・ソフトウェアに関する情報

JVN脆弱性詳細

OpenSSL の DTLS の実装における平文を復元される脆弱性

Title	OpenSSL の DTLS の実装における平文を復元される脆弱性
Summary	OpenSSL の DTLS の実装は、特定のパディングが有効である場合のみ MAC のチェックを実行するため、平文を復元される脆弱性が存在します。
Possible impacts	第三者により、パディングオラクル攻撃を介して、平文を復元される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 4, 2012, midnight
Registration Date	Jan. 10, 2012, 3:27 p.m.
Last Update	June 26, 2014, 1:52 p.m.

CVSS2.0 : 警告
Score	4.3
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N

Affected System

OpenSSL Project

OpenSSL 0.9.8s 未満

OpenSSL 1.0.0f 未満の 1.x

アップル

Apple Mac OS X 10.6.8

Apple Mac OS X v10.7 から v10.7.5

Apple Mac OS X v10.8 から v10.8.3

Apple Mac OS X Server 10.6.8

Apple Mac OS X Server v10.7 から v10.7.5

VMware

VMware ESX 3.5

VMware ESX 4.0

VMware ESX 4.1

VMware ESXi 3.5

VMware ESXi 4.0

VMware ESXi 4.1

VMware ESXi 5.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-4108	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4108
National Vulnerability Database (NVD)
2	CVE-2011-4108	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4108

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-310	https://jvndb.jvn.jp/ja/cwe/CWE-310.html

ベンダー情報

No	Name	URL
Apple Mailing Lists
1	APPLE-SA-2013-06-04-1	http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
Apple Security Updates
2	HT5784	http://support.apple.com/kb/HT5784
Apple セキュリティアップデート
3	HT5784	http://support.apple.com/kb/HT5784?viewlocale=ja_JP
OpenSSL Security Advisory
4	DTLS Plaintext Recovery Attack	http://www.openssl.org/news/secadv_20120104.txt
SECURITY BLOG
5	Multiple vulnerabilities in OpenSSL	https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_openssl
Turbolinux Security Advisory
6	TLSA-2014-1	http://www.turbolinux.co.jp/security/2014/TLSA-2014-1j.html
VMware Security Advisories
7	VMSA-2012-0013	http://www.vmware.com/jp/support/support-resources/advisories/VMSA-2012-0013.html

その他

No	Name	URL
JVN
1	JVNVU#91284469	http://jvn.jp/cert/JVNVU91284469/
2	JVNVU#92046435	http://jvn.jp/cert/JVNVU92046435/index.html

Change Log

No	Changed Details	Date of change
0	[2012年01月10日] 掲載 [2012年04月16日] ベンダ情報：オラクル (Multiple vulnerabilities in OpenSSL) を追加 [2012年11月02日] 影響を受けるシステム：VMware (VMSA-2012-0013) の情報を追加ベンダ情報：VMware (VMSA-2012-0013) を追加 [2013年06月07日] 影響を受けるシステム：アップル (HT5784) の情報を追加ベンダ情報：アップル (HT5784) を追加ベンダ情報：アップル (APPLE-SA-2013-06-04-1) を追加 [2014年06月26日] ベンダ情報：ターボリナックス (TLSA-2014-1) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-4108

Summary	The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
Publication Date	Jan. 6, 2012, 10:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:31 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7l:::::::*
cpe:2.3:a:openssl:openssl:0.9.6i:::::::*
cpe:2.3:a:openssl:openssl:0.9.8m:::::::*
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*
cpe:2.3:a:openssl:openssl:0.9.7c:::::::*
cpe:2.3:a:openssl:openssl:0.9.8n:::::::*
cpe:2.3:a:openssl:openssl:0.9.8p:::::::*
cpe:2.3:a:openssl:openssl:0.9.6d:::::::*
cpe:2.3:a:openssl:openssl:0.9.1c:::::::*
cpe:2.3:a:openssl:openssl:0.9.6:::::::*
cpe:2.3:a:openssl:openssl:0.9.7j:::::::*
cpe:2.3:a:openssl:openssl:0.9.6a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8e:::::::*
cpe:2.3:a:openssl:openssl:0.9.6h:bogus::::::
cpe:2.3:a:openssl:openssl:0.9.4:::::::*
cpe:2.3:a:openssl:openssl:0.9.8g:::::::*
cpe:2.3:a:openssl:openssl:0.9.8k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8d:::::::*
cpe:2.3:a:openssl:openssl:0.9.5a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8j:::::::*
cpe:2.3:a:openssl:openssl:0.9.6l:::::::*
cpe:2.3:a:openssl:openssl:0.9.7k:::::::*
cpe:2.3:a:openssl:openssl:0.9.7g:::::::*
cpe:2.3:a:openssl:openssl::::::::		0.9.8r
cpe:2.3:a:openssl:openssl:0.9.6e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7d:::::::*
cpe:2.3:a:openssl:openssl:0.9.8l:::::::*
cpe:2.3:a:openssl:openssl:0.9.7:::::::*
cpe:2.3:a:openssl:openssl:0.9.6b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7b:::::::*
cpe:2.3:a:openssl:openssl:0.9.6k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6g:::::::*
cpe:2.3:a:openssl:openssl:0.9.7m:::::::*
cpe:2.3:a:openssl:openssl:0.9.6h:::::::*
cpe:2.3:a:openssl:openssl:0.9.7i:::::::*
cpe:2.3:a:openssl:openssl:0.9.7h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8o:::::::*
cpe:2.3:a:openssl:openssl:0.9.8q:::::::*
cpe:2.3:a:openssl:openssl:0.9.6j:::::::*
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:0.9.7a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6c:::::::*
cpe:2.3:a:openssl:openssl:0.9.6m:::::::*
cpe:2.3:a:openssl:openssl:0.9.8i:::::::*
cpe:2.3:a:openssl:openssl:0.9.8f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8h:::::::*
cpe:2.3:a:openssl:openssl:0.9.2b:::::::*
cpe:2.3:a:openssl:openssl:0.9.5:::::::*
cpe:2.3:a:openssl:openssl:0.9.7f:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:1.0.0c:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta1::::::
cpe:2.3:a:openssl:openssl:1.0.0:beta2::::::
cpe:2.3:a:openssl:openssl:1.0.0:beta3::::::
cpe:2.3:a:openssl:openssl:1.0.0d:::::::*
cpe:2.3:a:openssl:openssl::::::::		1.0.0e
cpe:2.3:a:openssl:openssl:1.0.0:beta4::::::
cpe:2.3:a:openssl:openssl:1.0.0:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta5::::::
cpe:2.3:a:openssl:openssl:1.0.0a:::::::*
cpe:2.3:a:openssl:openssl:1.0.0b:::::::*

Related information, measures and tools

No	URL	タグ
1	http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
2	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
3	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
4	http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
5	http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html
6	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html
7	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html
8	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
9	http://marc.info/?l=bugtraq&m=132750648501816&w=2
10	http://marc.info/?l=bugtraq&m=132750648501816&w=2
11	http://marc.info/?l=bugtraq&m=133951357207000&w=2
12	http://marc.info/?l=bugtraq&m=133951357207000&w=2
13	http://marc.info/?l=bugtraq&m=134039053214295&w=2
14	http://marc.info/?l=bugtraq&m=134039053214295&w=2
15	http://rhn.redhat.com/errata/RHSA-2012-1306.html
16	http://rhn.redhat.com/errata/RHSA-2012-1307.html
17	http://rhn.redhat.com/errata/RHSA-2012-1308.html
18	http://secunia.com/advisories/48528
19	http://secunia.com/advisories/57260
20	http://secunia.com/advisories/57353
21	http://support.apple.com/kb/HT5784
22	http://www.debian.org/security/2012/dsa-2390
23	http://www.isg.rhul.ac.uk/~kp/dtls.pdf
24	http://www.kb.cert.org/vuls/id/737740	US Government Resource
25	http://www.mandriva.com/security/advisories?name=MDVSA-2012:006
26	http://www.mandriva.com/security/advisories?name=MDVSA-2012:007
27	http://www.openssl.org/news/secadv_20120104.txt	Vendor Advisory
28	http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
29	https://security.paloaltonetworks.com/CVE-2011-4108
30	http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc
31	https://security.paloaltonetworks.com/CVE-2011-4108
32	http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564
33	http://www.openssl.org/news/secadv_20120104.txt	Vendor Advisory
34	http://www.mandriva.com/security/advisories?name=MDVSA-2012:007
35	http://www.mandriva.com/security/advisories?name=MDVSA-2012:006
36	http://www.kb.cert.org/vuls/id/737740	US Government Resource
37	http://www.isg.rhul.ac.uk/~kp/dtls.pdf
38	http://www.debian.org/security/2012/dsa-2390
39	http://support.apple.com/kb/HT5784
40	http://secunia.com/advisories/57353
41	http://secunia.com/advisories/57260
42	http://secunia.com/advisories/48528
43	http://rhn.redhat.com/errata/RHSA-2012-1308.html
44	http://rhn.redhat.com/errata/RHSA-2012-1307.html
45	http://rhn.redhat.com/errata/RHSA-2012-1306.html
46	http://marc.info/?l=bugtraq&m=134039053214295&w=2
47	http://marc.info/?l=bugtraq&m=134039053214295&w=2
48	http://marc.info/?l=bugtraq&m=133951357207000&w=2
49	http://marc.info/?l=bugtraq&m=133951357207000&w=2
50	http://marc.info/?l=bugtraq&m=132750648501816&w=2
51	http://marc.info/?l=bugtraq&m=132750648501816&w=2
52	http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00001.html
53	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00018.html
54	http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00017.html
55	http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html
56	http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
57	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041
58	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03360041

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:0.9.8b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7l:::::::*
cpe:2.3:a:openssl:openssl:0.9.6i:::::::*
cpe:2.3:a:openssl:openssl:0.9.8m:::::::*
cpe:2.3:a:openssl:openssl:0.9.8c:::::::*
cpe:2.3:a:openssl:openssl:0.9.7c:::::::*
cpe:2.3:a:openssl:openssl:0.9.8n:::::::*
cpe:2.3:a:openssl:openssl:0.9.8p:::::::*
cpe:2.3:a:openssl:openssl:0.9.6d:::::::*
cpe:2.3:a:openssl:openssl:0.9.1c:::::::*
cpe:2.3:a:openssl:openssl:0.9.6:::::::*
cpe:2.3:a:openssl:openssl:0.9.7j:::::::*
cpe:2.3:a:openssl:openssl:0.9.6a:::::::*
cpe:2.3:a:openssl:openssl:0.9.8e:::::::*
cpe:2.3:a:openssl:openssl:0.9.6h:bogus::::::
cpe:2.3:a:openssl:openssl:0.9.4:::::::*
cpe:2.3:a:openssl:openssl:0.9.8g:::::::*
cpe:2.3:a:openssl:openssl:0.9.8k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8d:::::::*
cpe:2.3:a:openssl:openssl:0.9.5a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8j:::::::*
cpe:2.3:a:openssl:openssl:0.9.6l:::::::*
cpe:2.3:a:openssl:openssl:0.9.7k:::::::*
cpe:2.3:a:openssl:openssl:0.9.7g:::::::*
cpe:2.3:a:openssl:openssl::::::::		0.9.8r
cpe:2.3:a:openssl:openssl:0.9.6e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7d:::::::*
cpe:2.3:a:openssl:openssl:0.9.8l:::::::*
cpe:2.3:a:openssl:openssl:0.9.7:::::::*
cpe:2.3:a:openssl:openssl:0.9.6b:::::::*
cpe:2.3:a:openssl:openssl:0.9.7e:::::::*
cpe:2.3:a:openssl:openssl:0.9.7b:::::::*
cpe:2.3:a:openssl:openssl:0.9.6k:::::::*
cpe:2.3:a:openssl:openssl:0.9.8a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6g:::::::*
cpe:2.3:a:openssl:openssl:0.9.7m:::::::*
cpe:2.3:a:openssl:openssl:0.9.6h:::::::*
cpe:2.3:a:openssl:openssl:0.9.7i:::::::*
cpe:2.3:a:openssl:openssl:0.9.7h:::::::*
cpe:2.3:a:openssl:openssl:0.9.8o:::::::*
cpe:2.3:a:openssl:openssl:0.9.8q:::::::*
cpe:2.3:a:openssl:openssl:0.9.6j:::::::*
cpe:2.3:a:openssl:openssl:0.9.8:::::::*
cpe:2.3:a:openssl:openssl:0.9.7a:::::::*
cpe:2.3:a:openssl:openssl:0.9.6c:::::::*
cpe:2.3:a:openssl:openssl:0.9.6m:::::::*
cpe:2.3:a:openssl:openssl:0.9.8i:::::::*
cpe:2.3:a:openssl:openssl:0.9.8f:::::::*
cpe:2.3:a:openssl:openssl:0.9.8h:::::::*
cpe:2.3:a:openssl:openssl:0.9.2b:::::::*
cpe:2.3:a:openssl:openssl:0.9.5:::::::*
cpe:2.3:a:openssl:openssl:0.9.7f:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:1.0.0c:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta1::::::
cpe:2.3:a:openssl:openssl:1.0.0:beta2::::::
cpe:2.3:a:openssl:openssl:1.0.0:beta3::::::
cpe:2.3:a:openssl:openssl:1.0.0d:::::::*
cpe:2.3:a:openssl:openssl::::::::		1.0.0e
cpe:2.3:a:openssl:openssl:1.0.0:beta4::::::
cpe:2.3:a:openssl:openssl:1.0.0:::::::*
cpe:2.3:a:openssl:openssl:1.0.0:beta5::::::
cpe:2.3:a:openssl:openssl:1.0.0a:::::::*
cpe:2.3:a:openssl:openssl:1.0.0b:::::::*