CVE-2012-2110

OpenSSL < 0.9.8v, 1.0.0 < 1.0.0i, 1.0.1 < 1.0.1a - Buffer Overflow via Crafted DER Data

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-2110. PoCs published by Tavis Ormandy.

AI-analyzed exploit summary This is a detailed technical writeup explaining the integer conversion vulnerabilities in OpenSSL (CVE-2012-2110) that lead to memory corruption. It describes how improper handling of ASN.1 data can result in heap overflows due to incorrect integer truncation and sign extension.

Description

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Tavis Ormandy · textdosmultiple

https://www.exploit-db.com/exploits/18756

View Code ZIP pw:eip

This is a detailed technical writeup explaining the integer conversion vulnerabilities in OpenSSL (CVE-2012-2110) that lead to memory corruption. It describes how improper handling of ASN.1 data can result in heap overflows due to incorrect integer truncation and sign extension.

Classification

Writeup 100%

Attack Type

Dos

Complexity

Moderate

Reliability

Reliable

Target: OpenSSL up to and including version 1.0.1

No auth needed

Prerequisites: Ability to provide maliciously crafted ASN.1 data to a vulnerable OpenSSL instance

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (39)

Core 39

Core References

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00014.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00007.html

Various Sources x_refsource_confirm

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564

Various Sources vendor-advisory x_refsource_hp

https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03839862

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092905.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/48899

Exploit mailing-list x_refsource_fulldisc

http://archives.neohapsis.com/archives/fulldisclosure/2012-04/0209.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2012-1308.html

Vendor Advisory x_refsource_confirm

http://cvs.openssl.org/chngview?cn=22434

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2012:060

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2012-1307.html

Exploit, Third Party Advisory exploit x_refsource_exploit-db

http://www.exploit-db.com/exploits/18756

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2012-0518.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2012/dsa-2454

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT5784

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1424-1

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/48895

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/48847

Vendor Advisory x_refsource_confirm

http://cvs.openssl.org/chngview?cn=22439

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2012-1306.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00015.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2012-0522.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079149.html

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=134039053214295&w=2

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/57353

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/53158

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=133728068926468&w=2

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080176.html

Various Sources x_refsource_confirm

http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578

Mailing List vendor-advisory x_refsource_hp

http://marc.info/?l=bugtraq&m=133951357207000&w=2

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/48942

Vendor Advisory x_refsource_confirm

http://www.openssl.org/news/secadv_20120419.txt

Vendor Advisory x_refsource_confirm

http://cvs.openssl.org/chngview?cn=22431

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1026957

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/48999

Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb

http://osvdb.org/81223

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079299.html

Vendor Advisory x_refsource_confirm

https://kb.juniper.net/KB27376

Scores

EPSS 0.4830

EPSS Percentile 98.7%

Details

CWE

CWE-119

Status published

Products (29)

openssl/openssl 1.0.0 (6 CPE variants)

openssl/openssl 1.0.0a

openssl/openssl 1.0.0b

openssl/openssl 1.0.0c

openssl/openssl 1.0.0d

openssl/openssl 1.0.0e

openssl/openssl 1.0.0g

openssl/openssl 0.9.1c

openssl/openssl 0.9.2b

openssl/openssl 0.9.3

... and 19 more

Published Apr 19, 2012

Tracked Since Feb 18, 2026