Vulnerability Details : CVE-2012-2191
IBM Global Security Kit (aka GSKit) before 8.0.14.22, as used in IBM Rational Directory Server, IBM Tivoli Directory Server, and other products, does not properly validate data during execution of a protection mechanism against the Vaudenay SSL CBC timing attack, which allows remote attackers to cause a denial of service (application crash) via crafted values in the TLS Record Layer, a different vulnerability than CVE-2012-2333.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2012-2191
- cpe:2.3:a:ibm:tivoli_directory_server:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.28:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:global_security_kit:7.0.4.29:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:rational_directory_server:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2012-2191
10.74%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2012-2191
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2012-2191
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-2191
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IV31980
IBM IV31980: SYSROUTE OF IV31971:GSKIT SSL/TLS RECORD LENGTH VULNERABILITY INTIVOLI ACCESS MANAGER FOR E-BUSINESS (CVE-2012-2191)
-
http://www.securityfocus.com/bid/54743
IBM Multiple Products Global Security Toolkit Security Vulnerabilities
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/75996
Multiple IBM products GSKit SSL/TLS record layer processing denial of service CVE-2012-2191 Vulnerability Report
-
http://www-01.ibm.com/support/docview.wss?uid=swg21606145
IBM Security Bulletin: Multiple vulnerabilities in Rational Directory Server (CVE-2012-2203, CVE-2012-2191)Patch;Vendor Advisory
-
http://www-01.ibm.com/support/docview.wss?uid=swg1IV31981
IBM IV31981: SYSROUTE OF IV31971:GSKIT SSL/TLS RECORD LENGTH VULNERABILITY IN TIVOLI ACCESS MANAGER FOR E-BUSINESS (CVE-2012-2191)
Jump to