CVE-2012-4930 SPDY TLS CRIME Side-Channel Attack Analysis

Key Information CVE Number: CVE-2012-4930, CVE-2012-4930 Vulnerability Name: SPDY: SSL/TLS CRIME attack Status: CLOSED NOTABUG Product: Security Response Component: vulnerability Environment: Linux Priority: medium Severity: medium Reported Time: 2012-09-16 16:44 UTC Modified Time: 2021-02-23 13:52 UTC Description SPDY protocol versions 3 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can encrypt compressed data over TLS without properly obfuscating the length of unencrypted data. This allows a man-in-the-middle attacker to infer plaintext in HTTP headers by observing length differences, enabling a series of guesses. Specifically, strings in HTTP requests may match unknown strings in HTTP headers, leading to what is known as the "CRIME" attack. References http://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/ http://iscpartners.com/blog/2012/9/14/details-on-the-crime-attack.html http://threatpost.com/en_us/blogs/crime-attack-uses-compression-ratio-tls-requests-side-channel-hijack-secure-sessions-091312 http://www.ekoparty.org/2012/thai-duong.php http://www.iacr.org/cryptodb/data/paper.php?pubkey=3091 http://www.theregister.co.uk/2012/09/14/crime_tls_attack/ https://community.qualys.com/blogs/securitylabs/2012/09/14/crime-information-leakage-attack-against-ssltls Additional Information The reporter described two variants of the attack: Data compressed with zlib over SSL/TLS connections — this issue is assigned CVE-2012-4929 and tracked via bug 857051. SPDY protocol using header compression over SSL/TLS connections, without zlib compression — tracked via this vulnerability. Bug 857051 includes additional information and links regarding the CRIME attack. It also notes (in bug 857051, comment 4) that Mozilla Firefox in Red Hat Enterprise Linux 5 and 6 does not support the SPDY protocol, and thus is not affected by this SPDY-specific variant of the attack. Duplicates Bug 859027 has been marked as a duplicate of this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2012-4930 SPDY TLS CRIME Side-Channel Attack Analysis