CVE-2011-4576
Summary
| CVE | CVE-2011-4576 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-01-06 01:55:00 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Openssl | Openssl | 0.9.1c | All | All | All |
| Application | Openssl | Openssl | 0.9.2b | All | All | All |
| Application | Openssl | Openssl | 0.9.4 | All | All | All |
| Application | Openssl | Openssl | 0.9.5 | All | All | All |
| Application | Openssl | Openssl | 0.9.5a | All | All | All |
| Application | Openssl | Openssl | 0.9.6 | All | All | All |
| Application | Openssl | Openssl | 0.9.6a | All | All | All |
| Application | Openssl | Openssl | 0.9.6b | All | All | All |
| Application | Openssl | Openssl | 0.9.6c | All | All | All |
| Application | Openssl | Openssl | 0.9.6d | All | All | All |
| Application | Openssl | Openssl | 0.9.6e | All | All | All |
| Application | Openssl | Openssl | 0.9.6f | All | All | All |
| Application | Openssl | Openssl | 0.9.6g | All | All | All |
| Application | Openssl | Openssl | 0.9.6h | All | All | All |
| Application | Openssl | Openssl | 0.9.6h | bogus | All | All |
| Application | Openssl | Openssl | 0.9.6i | All | All | All |
| Application | Openssl | Openssl | 0.9.6j | All | All | All |
| Application | Openssl | Openssl | 0.9.6k | All | All | All |
| Application | Openssl | Openssl | 0.9.6l | All | All | All |
| Application | Openssl | Openssl | 0.9.6m | All | All | All |
| Application | Openssl | Openssl | 0.9.7 | All | All | All |
| Application | Openssl | Openssl | 0.9.7a | All | All | All |
| Application | Openssl | Openssl | 0.9.7b | All | All | All |
| Application | Openssl | Openssl | 0.9.7c | All | All | All |
| Application | Openssl | Openssl | 0.9.7d | All | All | All |
| Application | Openssl | Openssl | 0.9.7e | All | All | All |
| Application | Openssl | Openssl | 0.9.7f | All | All | All |
| Application | Openssl | Openssl | 0.9.7g | All | All | All |
| Application | Openssl | Openssl | 0.9.7h | All | All | All |
| Application | Openssl | Openssl | 0.9.7i | All | All | All |
| Application | Openssl | Openssl | 0.9.7j | All | All | All |
| Application | Openssl | Openssl | 0.9.7k | All | All | All |
| Application | Openssl | Openssl | 0.9.7l | All | All | All |
| Application | Openssl | Openssl | 0.9.7m | All | All | All |
| Application | Openssl | Openssl | 0.9.8 | All | All | All |
| Application | Openssl | Openssl | 0.9.8a | All | All | All |
| Application | Openssl | Openssl | 0.9.8b | All | All | All |
| Application | Openssl | Openssl | 0.9.8c | All | All | All |
| Application | Openssl | Openssl | 0.9.8d | All | All | All |
| Application | Openssl | Openssl | 0.9.8e | All | All | All |
| Application | Openssl | Openssl | 0.9.8f | All | All | All |
| Application | Openssl | Openssl | 0.9.8g | All | All | All |
| Application | Openssl | Openssl | 0.9.8h | All | All | All |
| Application | Openssl | Openssl | 0.9.8i | All | All | All |
| Application | Openssl | Openssl | 0.9.8j | All | All | All |
| Application | Openssl | Openssl | 0.9.8k | All | All | All |
| Application | Openssl | Openssl | 0.9.8l | All | All | All |
| Application | Openssl | Openssl | 0.9.8m | All | All | All |
| Application | Openssl | Openssl | 0.9.8n | All | All | All |
| Application | Openssl | Openssl | 0.9.8o | All | All | All |
| Application | Openssl | Openssl | 0.9.8p | All | All | All |
| Application | Openssl | Openssl | 0.9.8q | All | All | All |
| Application | Openssl | Openssl | 1.0.0 | All | All | All |
| Application | Openssl | Openssl | 1.0.0 | beta1 | All | All |
| Application | Openssl | Openssl | 1.0.0 | beta2 | All | All |
| Application | Openssl | Openssl | 1.0.0 | beta3 | All | All |
| Application | Openssl | Openssl | 1.0.0 | beta4 | All | All |
| Application | Openssl | Openssl | 1.0.0 | beta5 | All | All |
| Application | Openssl | Openssl | 1.0.0a | All | All | All |
| Application | Openssl | Openssl | 1.0.0b | All | All | All |
| Application | Openssl | Openssl | 1.0.0c | All | All | All |
| Application | Openssl | Openssl | 1.0.0d | All | All | All |
| Application | Openssl | Openssl | All | All | All | All |
| Application | Openssl | Openssl | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Alerts - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| '[security bulletin] HPSBUX02734 SSRT100729 rev.1 - HP-UX Running OpenSSL, Remote Denial of Service (' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| HPSBMU02786 SSRT100877 rev.2 - HP System Management Homepage (SMH) Running on Linux, Windows, and VMware ESX, Remote Unauthorized Access, Disclosure of Information, Data Modification, Denial of Service (DoS), Execution of Arbitrary Code - c03360041 - HP Business Support Center | af854a3a-2127-422b-91ae-364da2661108 | h20000.www2.hp.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| About the security content of OS X Mountain Lion v10.8.4 and Security Update 2013-002 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | |
| Support / Security / Advisories / / MDVSA-2012:006 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc | af854a3a-2127-422b-91ae-364da2661108 | aix.software.ibm.com | |
| [SECURITY] Fedora 18 Update: mingw-openssl-1.0.1c-1.fc18 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Debian -- Security Information -- DSA-2390-1 openssl | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| www.openssl.org/news/secadv_20120104.txt | af854a3a-2127-422b-91ae-364da2661108 | www.openssl.org | Vendor Advisory |
| Security Advisory SA57353 - IBM Storage System DS8870 OpenSSL Multiple Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| IBM Security Bulletin: Storage HMC OpenSSL upgrade to address cryptographic vulnerabilities. - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| Security Advisory SA55069 - IBM Sterling Connect:Direct OpenSSL Block Cipher Padding Vulnerability - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| '[security bulletin] HPSBMU02776 SSRT100852 rev.1 - HP Onboard Administrator (OA), Remote Unauthorize' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| APPLE-SA-2013-06-04-1 OS X Mountain Lion v10.8.4 and Security Update 2013-002 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | |
| Support / Security / Advisories / / MDVSA-2012:007 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Vulnerability Note VU#737740 - Fiery Network Controllers for Xerox DocuColor 242/252/260 Printer/Copier use a vulnerable version of OpenSSL | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | US Government Resource |
| [security-announce] openSUSE-SU-2012:0083-1: important: openssl: fixing | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| [security-announce] SUSE-SU-2012:0084-1: important: Security update for | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| '[security bulletin] HPSBOV02793 SSRT100891 rev.1 - HP OpenVMS running SSL, Remote Denial of Service' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 390226 Oracle Managed Virtualization (VM) Server for x86 Security Update for Open Secure Sockets Layer (OpenSSL) (OVMSA-2021-0011)
- 390284 Oracle Managed Virtualization (VM) Server for x86 Security Update for Open Secure Sockets Layer (OpenSSL) (OVMSA-2023-0013)
- 591350 General Electric D20MX Open Secure Sockets Layer (OpenSSL) Multiple Vulnerabilities (PRSN-0006)