OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
History
21 Nov 2024, 01:20
Type | Values Removed | Values Added |
---|---|---|
References | () http://cvs.openssl.org/chngview?cn=20131 - Broken Link, Patch | |
References | () http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777 - Broken Link | |
References | () http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html - Broken Link, Mailing List, Third Party Advisory | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html - Mailing List, Third Party Advisory | |
References | () http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html - Mailing List, Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html - Mailing List, Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html - Mailing List, Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html - Mailing List, Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html - Mailing List, Third Party Advisory | |
References | () http://marc.info/?l=bugtraq&m=129916880600544&w=2 - Issue Tracking, Third Party Advisory | |
References | () http://marc.info/?l=bugtraq&m=130497251507577&w=2 - Issue Tracking, Third Party Advisory | |
References | () http://marc.info/?l=bugtraq&m=132077688910227&w=2 - Issue Tracking, Third Party Advisory | |
References | () http://openssl.org/news/secadv_20101202.txt - Patch, Third Party Advisory | |
References | () http://osvdb.org/69565 - Broken Link | |
References | () http://secunia.com/advisories/42469 - Not Applicable | |
References | () http://secunia.com/advisories/42473 - Not Applicable | |
References | () http://secunia.com/advisories/42493 - Not Applicable | |
References | () http://secunia.com/advisories/42571 - Not Applicable | |
References | () http://secunia.com/advisories/42620 - Not Applicable | |
References | () http://secunia.com/advisories/42811 - Not Applicable | |
References | () http://secunia.com/advisories/42877 - Not Applicable | |
References | () http://secunia.com/advisories/43169 - Not Applicable | |
References | () http://secunia.com/advisories/43170 - Not Applicable | |
References | () http://secunia.com/advisories/43171 - Not Applicable | |
References | () http://secunia.com/advisories/43172 - Not Applicable | |
References | () http://secunia.com/advisories/43173 - Not Applicable | |
References | () http://secunia.com/advisories/44269 - Not Applicable | |
References | () http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668471 - Third Party Advisory | |
References | () http://support.apple.com/kb/HT4723 - Third Party Advisory | |
References | () http://ubuntu.com/usn/usn-1029-1 - Third Party Advisory | |
References | () http://www.debian.org/security/2011/dsa-2141 - Third Party Advisory | |
References | () http://www.kb.cert.org/vuls/id/737740 - Third Party Advisory, US Government Resource | |
References | () http://www.mandriva.com/security/advisories?name=MDVSA-2010:248 - Permissions Required | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0977.html - Third Party Advisory | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0978.html - Third Party Advisory | |
References | () http://www.redhat.com/support/errata/RHSA-2010-0979.html - Third Party Advisory | |
References | () http://www.redhat.com/support/errata/RHSA-2011-0896.html - Vendor Advisory | |
References | () http://www.securityfocus.com/archive/1/522176 - Third Party Advisory, VDB Entry | |
References | () http://www.securityfocus.com/bid/45164 - Third Party Advisory, VDB Entry | |
References | () http://www.securitytracker.com/id?1024822 - Broken Link, Third Party Advisory, VDB Entry | |
References | () http://www.vupen.com/english/advisories/2010/3120 - Permissions Required | |
References | () http://www.vupen.com/english/advisories/2010/3122 - Permissions Required | |
References | () http://www.vupen.com/english/advisories/2010/3134 - Permissions Required | |
References | () http://www.vupen.com/english/advisories/2010/3188 - Permissions Required | |
References | () http://www.vupen.com/english/advisories/2011/0032 - Permissions Required | |
References | () http://www.vupen.com/english/advisories/2011/0076 - Permissions Required | |
References | () http://www.vupen.com/english/advisories/2011/0268 - Permissions Required | |
References | () https://bugzilla.redhat.com/show_bug.cgi?id=659462 - Issue Tracking, Patch, Third Party Advisory | |
References | () https://kb.bluecoat.com/index?page=content&id=SA53&actp=LIST - Broken Link | |
References | () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18910 - Third Party Advisory |
Information
Published : 2010-12-06 21:05
Updated : 2024-11-21 01:20
NVD link : CVE-2010-4180
Mitre link : CVE-2010-4180
CVE.ORG link : CVE-2010-4180
JSON object : View
Products Affected
opensuse
- opensuse
canonical
- ubuntu_linux
suse
- linux_enterprise_server
- linux_enterprise_desktop
- linux_enterprise
f5
- nginx
openssl
- openssl
debian
- debian_linux
fedoraproject
- fedora
CWE