Transport Layer Security (TLS) Protocol CRIME Vulnerability
low Nessus Plugin ID 62565
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 6.5
Synopsis
The remote service has a configuration that may make it vulnerable to the CRIME attack.Description
The remote service has one of two configurations that are known to be required for the CRIME attack :- SSL / TLS compression is enabled.
- TLS advertises the SPDY protocol earlier than version 4.
Note that Nessus did not attempt to launch the CRIME attack against the remote service.
Solution
Disable compression and / or the SPDY service.See Also
https://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
https://discussions.nessus.org/thread/5546
Plugin Details
Severity: Low
ID: 62565
File Name: ssl_crime.nasl
Version: 1.14
Type: remote
Family: General
Published: 10/16/2012
Updated: 12/4/2019
Dependencies: ssl_supported_compression.nasl, ssl_supported_protocols.nasl
Risk Information
Risk Factor: Low
VPR Score: 6.5
CVSS Score Source: CVE-2012-4930
CVSS v2.0
Base Score: 2.6
Temporal Score: 1.9
Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N
Temporal Vector: E:U/RL:OF/RC:C
Vulnerability Information
Required KB Items: SSL/Supported
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 9/15/2012
Reference Information
CVE: CVE-2012-4929, CVE-2012-4930