| Descripción: | Summary:
The remote SSL/TLS service is prone to a man-in-the-middle
(MITM) vulnerability.
Vulnerability Insight:
The flaw exists because the remote SSL/TLS service does not
properly associate renegotiation handshakes with an existing connection, which allows MITM
attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by
TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a
post-renegotiation context, related to a 'plaintext injection' attack, aka the 'Project Mogul'
issue.
Vulnerability Impact:
A remote, unauthenticated attacker may be able to inject an
arbitrary amount of chosen plaintext into the beginning of the application protocol stream. This
could allow and attacker to issue HTTP requests, or take action impersonating the user, among
other consequences.
Affected Software/OS:
The TLS protocol, and the SSL protocol 3.0 and possibly
earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP
Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network
Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products.
Solution:
Users should contact their vendors for specific patch information.
General solution options are:
- remove/disable renegotiation capabilities altogether from/in the affected SSL/TLS service
- enable Safe/Secure renegotiation (RFC5746) for the affected SSL/TLS service
CVSS Score:
5.8
CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:P
|
