Published: 06/12/2010 Updated: 04/08/2022

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 384

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Subscribe to Openssl

OpenSSL prior to 0.9.8q, and 1.0.x prior to 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote malicious users to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl
fedoraproject fedora 13
fedoraproject fedora 14
debian debian linux 5.0
canonical ubuntu linux 10.10
canonical ubuntu linux 9.04
canonical ubuntu linux 8.04
canonical ubuntu linux 10.04
canonical ubuntu linux 6.06
suse linux enterprise desktop 11
opensuse opensuse 11.1
suse linux enterprise server 9
opensuse opensuse 11.4
opensuse opensuse 11.2
opensuse opensuse 11.3
suse linux enterprise desktop 10
suse linux enterprise server 10
suse linux enterprise 11.0
f5 nginx

It was discovered that an old bug workaround in the SSL/TLS server code allowed an attacker to modify the stored session cache ciphersuite This could possibly allow an attacker to downgrade the ciphersuite to a weaker one on subsequent connections (CVE-2010-4180) ...

DSA-2141 consists of three individual parts, which can be viewed in the mailing list archive: DSA 2141-1 (openssl), DSA 2141-2 (nss), DSA 2141-3 (apache2), and DSA 2141-4 (lighttpd) This page only covers the first part, openssl CVE-2009-3555 Marsh Ray, Steve Dispensa, and Martin Rex discovered a flaw in the TLS and SSLv3 protocols If an attacke ...

NVD-CWE-noinfo http://cvs.openssl.org/chngview?cn=20131 https://bugzilla.redhat.com/show_bug.cgi?id=659462 http://openssl.org/news/secadv_20101202.txt http://www.vupen.com/english/advisories/2010/3120 http://www.vupen.com/english/advisories/2010/3122 http://ubuntu.com/usn/usn-1029-1 http://secunia.com/advisories/42473 http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668471 http://www.vupen.com/english/advisories/2010/3134 http://osvdb.org/69565 http://www.securitytracker.com/id?1024822 http://secunia.com/advisories/42493 http://www.mandriva.com/security/advisories?name=MDVSA-2010:248 http://www.securityfocus.com/bid/45164 http://secunia.com/advisories/42469 http://www.vupen.com/english/advisories/2010/3188 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html http://www.redhat.com/support/errata/RHSA-2010-0979.html http://secunia.com/advisories/42620 http://secunia.com/advisories/42571 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html http://www.debian.org/security/2011/dsa-2141 http://secunia.com/advisories/42811 http://www.vupen.com/english/advisories/2011/0032 http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html http://www.redhat.com/support/errata/RHSA-2010-0977.html http://www.redhat.com/support/errata/RHSA-2010-0978.html http://secunia.com/advisories/42877 http://www.vupen.com/english/advisories/2011/0076 http://www.vupen.com/english/advisories/2011/0268 http://secunia.com/advisories/43171 http://secunia.com/advisories/43172 http://secunia.com/advisories/43169 http://secunia.com/advisories/43173 http://secunia.com/advisories/43170 https://kb.bluecoat.com/index?page=content&id=SA53&actp=LIST http://secunia.com/advisories/44269 http://support.apple.com/kb/HT4723 http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html http://www.redhat.com/support/errata/RHSA-2011-0896.html http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html http://marc.info/?l=bugtraq&m=132077688910227&w=2 http://www.securityfocus.com/archive/1/522176 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777 http://www.kb.cert.org/vuls/id/737740 http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html http://marc.info/?l=bugtraq&m=129916880600544&w=2 http://marc.info/?l=bugtraq&m=130497251507577&w=2 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18910 https://usn.ubuntu.com/1029-1/https://nvd.nist.gov https://www.kb.cert.org/vuls/id/737740

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook