CVE-2012-2191

2012-08-0810:26:00

CWE-20

[email protected]

web.nvd.nist.gov

ibm

gskit

ssl

denial of service

vulnerability

cve-2012-2191

8.8 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.068 Low

EPSS

Percentile

93.8%

JSON

IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, does not properly validate data during execution of a protection mechanism against the Vaudenay SSL CBC timing attack, which allows remote attackers to cause a denial of service (application crash) via crafted values in the TLS Record Layer, a different vulnerability than CVE-2012-2333.

CPENameOperatorVersion
ibm:rational_directory_serveribm rational directory servereq*
ibm:tivoli_directory_serveribm tivoli directory servereq*
ibm:global_security_kitibm global security kitle8.0.13
ibm:global_security_kitibm global security kiteq7.0.4.29
ibm:global_security_kitibm global security kiteq7.0.4.28

CPE	Name	Operator	Version
ibm:rational_directory_server	ibm rational directory server	eq	*
ibm:tivoli_directory_server	ibm tivoli directory server	eq	*
ibm:global_security_kit	ibm global security kit	le	8.0.13
ibm:global_security_kit	ibm global security kit	eq	7.0.4.29
ibm:global_security_kit	ibm global security kit	eq	7.0.4.28