Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Vulnerability protection

TLS vulnerability could allow information disclosure


Report ID: MS201207007
Date Published: 16 July 2012

Criticality: Important
Compromise Type: information-disclosure
Compromise From: remote


Affected Product/Component:

Windows XP
Windows Server 2003
Windows Vista
Windows Server 2008
Windows 7
Windows Server 2008 R2




Summary

A vulnerability in the TLS encryption protocol could allow a successful attacker to decrypt encrypted traffic, leading to information disclosure.



Detailed Description

Microsoft has issued a security update to equip its system against a vulnerability in the Transport Layer Security (TLS) protocol. The vulnerability was caused by a design flaw in the protocol when Cipher-block chaining (CBC) mode of operation is used. It affects the protocol itself and is not specific to Windows operating system. Upon successful exploit, an attacker could be able to intercept and decrypt encrypted traffic, which leads to information disclosure.

The issued update introduces modification in the way that the Windows Secure Channel (SChannel) and the Cryptography API: Next Generation (CNG) components handle encrypted network packets. Users are recommended to install this latest update to protect their systems from potential exploit attempts.



CVE Reference

CVE-2012-1870



Solution

Install the latest security patch for applicable system, available for download from (https://technet.microsoft.com/en-us/security/bulletin/ms12-049)




Security Advisories

For a list of known vulnerabilities affecting F-Secure products and the released fixes, please refer to the Security Advisories page.