CVE-2012-2191

2012-08-0810:26:18

CWE-20

[email protected]

web.nvd.nist.gov

ibm

gskit

ssl

denial of service

vulnerability

cve-2012-2191

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

8.8 High

AI Score

Confidence

High

0.068 Low

EPSS

Percentile

93.9%

JSON

IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, does not properly validate data during execution of a protection mechanism against the Vaudenay SSL CBC timing attack, which allows remote attackers to cause a denial of service (application crash) via crafted values in the TLS Record Layer, a different vulnerability than CVE-2012-2333.

Affected configurations

NVD

Node

ibmglobal_security_kitRange≤8.0.13

ibmglobal_security_kitMatch7.0.4.28

ibmglobal_security_kitMatch7.0.4.29

ibmrational_directory_server

ibmtivoli_directory_server

CPENameOperatorVersion
ibm:global_security_kitibm global security kitle8.0.13
ibm:global_security_kitibm global security kiteq7.0.4.28
ibm:global_security_kitibm global security kiteq7.0.4.29
ibm:rational_directory_serveribm rational directory servereq*
ibm:tivoli_directory_serveribm tivoli directory servereq*

CPE	Name	Operator	Version
ibm:global_security_kit	ibm global security kit	le	8.0.13
ibm:global_security_kit	ibm global security kit	eq	7.0.4.28
ibm:global_security_kit	ibm global security kit	eq	7.0.4.29
ibm:rational_directory_server	ibm rational directory server	eq	*
ibm:tivoli_directory_server	ibm tivoli directory server	eq	*