CVE-2010-4252

Openssl < 1.0.0b - Authentication Bypass

Title source: rule
STIX 2.1

Description

OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.

References (16)

Core 16
Core References
Patch x_refsource_confirm
http://cvs.openssl.org/chngview?cn=20098
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19039
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3120
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3122
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42469
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=130497251507577&w=2
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/45163
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1024823
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=129916880600544&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/57353
Vendor Advisory x_refsource_confirm
http://openssl.org/news/secadv_20101202.txt

Scores

EPSS 0.0180
EPSS Percentile 82.9%

Details

CWE
CWE-287
Status published
Products (34)
openssl/openssl 0.9.1c
openssl/openssl 0.9.2b
openssl/openssl 0.9.3
openssl/openssl 0.9.3a
openssl/openssl 0.9.4
openssl/openssl 0.9.5 (3 CPE variants)
openssl/openssl 0.9.5a (3 CPE variants)
openssl/openssl 0.9.6 (4 CPE variants)
openssl/openssl 0.9.6a (4 CPE variants)
openssl/openssl 0.9.6b
... and 24 more
Published Dec 06, 2010
Tracked Since Feb 18, 2026