CVE-2012-2191

2012-08-0810:26:18

CWE-20

[email protected]

web.nvd.nist.gov

ibm

gskit

ssl

denial of service

vulnerability

cve-2012-2191

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

8.8

Confidence

High

EPSS

0.068

Percentile

93.9%

JSON

IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, does not properly validate data during execution of a protection mechanism against the Vaudenay SSL CBC timing attack, which allows remote attackers to cause a denial of service (application crash) via crafted values in the TLS Record Layer, a different vulnerability than CVE-2012-2333.

Affected configurations

NVD

Node

ibmglobal_security_kitRange≤8.0.13

ibmglobal_security_kitMatch7.0.4.28

ibmglobal_security_kitMatch7.0.4.29

ibmrational_directory_server

ibmtivoli_directory_server

VendorProductVersionCPE
ibmglobal_security_kit7.0.4.29cpe:/a:ibm:global_security_kit:7.0.4.29:::
ibmrational_directory_servercpe:/a:ibm:rational_directory_server::::
ibmtivoli_directory_servercpe:/a:ibm:tivoli_directory_server::::
ibmglobal_security_kit7.0.4.28cpe:/a:ibm:global_security_kit:7.0.4.28:::
ibmglobal_security_kitcpe:/a:ibm:global_security_kit::::

Vendor	Product	Version	CPE
ibm	global_security_kit	7.0.4.29	cpe:/a:ibm:global_security_kit:7.0.4.29:::
ibm	rational_directory_server		cpe:/a:ibm:rational_directory_server::::
ibm	tivoli_directory_server		cpe:/a:ibm:tivoli_directory_server::::
ibm	global_security_kit	7.0.4.28	cpe:/a:ibm:global_security_kit:7.0.4.28:::
ibm	global_security_kit		cpe:/a:ibm:global_security_kit::::