CVE-2012-4929
Debian Linux - Information Disclosure via TLS Compression Length Oracle
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2012-4929. PoCs published by mpgn, anthophilee.
AI-analyzed exploit summary This repository contains a proof-of-concept implementation of the CRIME attack (CVE-2012-4929), demonstrating how compression oracle attacks can be used to decrypt encrypted data by exploiting differences in compressed data lengths. The PoC includes implementations for both AES-CBC and RC4 cipher modes.
Description
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.
Exploits (2)
This repository contains a proof-of-concept implementation of the CRIME attack (CVE-2012-4929), demonstrating how compression oracle attacks can be used to decrypt encrypted data by exploiting differences in compressed data lengths. The PoC includes implementations for both AES-CBC and RC4 cipher modes.
This repository contains a Python-based scanner tool (A2SV) designed to detect multiple SSL/TLS vulnerabilities, including CVE-2015-0204 (FREAK Attack). It automates the scanning process for various CVEs by leveraging Python scripts and dependencies.