CVE-2009-3555

Description

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.

References

http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html

http://blogs.iss.net/archive/sslmitmiscsrf.html

http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041

http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751

http://kbase.redhat.com/faq/docs/DOC-20491

http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html

http://lists.apple.com/archives/security-announce/2010//May/msg00001.html

http://lists.apple.com/archives/security-announce/2010//May/msg00002.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html

http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html

http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html

http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2

http://marc.info/?l=bugtraq&m=126150535619567&w=2

http://marc.info/?l=bugtraq&m=127128920008563&w=2

http://marc.info/?l=bugtraq&m=127419602507642&w=2

http://marc.info/?l=bugtraq&m=127557596201693&w=2

http://marc.info/?l=bugtraq&m=130497311408250&w=2

http://marc.info/?l=bugtraq&m=132077688910227&w=2

http://marc.info/?l=bugtraq&m=133469267822771&w=2

http://marc.info/?l=bugtraq&m=134254866602253&w=2

http://marc.info/?l=bugtraq&m=142660345230545&w=2

http://marc.info/?l=cryptography&m=125752275331877&w=2

https://bugzilla.mozilla.org/show_bug.cgi?id=526689

https://bugzilla.mozilla.org/show_bug.cgi?id=545755

https://bugzilla.redhat.com/show_bug.cgi?id=533125

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049

http://seclists.org/fulldisclosure/2009/Nov/139

http://secunia.com/advisories/37291

http://secunia.com/advisories/37292

http://secunia.com/advisories/37320

http://secunia.com/advisories/37383

http://secunia.com/advisories/37399

http://secunia.com/advisories/37453

http://secunia.com/advisories/37501

http://secunia.com/advisories/37504

http://secunia.com/advisories/37604

http://secunia.com/advisories/37640

http://secunia.com/advisories/37656

http://secunia.com/advisories/37675

http://secunia.com/advisories/37859

http://secunia.com/advisories/38003

http://secunia.com/advisories/38020

http://secunia.com/advisories/38056

http://secunia.com/advisories/38241

http://secunia.com/advisories/38484

http://secunia.com/advisories/38687

http://secunia.com/advisories/38781

http://secunia.com/advisories/39127

http://secunia.com/advisories/39136

http://secunia.com/advisories/39242

http://secunia.com/advisories/39243

http://secunia.com/advisories/39278

http://secunia.com/advisories/39292

http://secunia.com/advisories/39317

http://secunia.com/advisories/39461

http://secunia.com/advisories/39500

http://secunia.com/advisories/39628

http://secunia.com/advisories/39632

http://secunia.com/advisories/39713

http://secunia.com/advisories/39819

http://secunia.com/advisories/40070

http://secunia.com/advisories/40545

http://secunia.com/advisories/40747

http://secunia.com/advisories/40866

http://secunia.com/advisories/41480

http://secunia.com/advisories/41490

http://secunia.com/advisories/41818

http://secunia.com/advisories/41967

http://secunia.com/advisories/41972

http://secunia.com/advisories/42377

http://secunia.com/advisories/42379

http://secunia.com/advisories/42467

http://secunia.com/advisories/42724

http://secunia.com/advisories/42733

http://secunia.com/advisories/42808

http://secunia.com/advisories/42811

http://secunia.com/advisories/42816

http://secunia.com/advisories/43308

http://secunia.com/advisories/44183

http://secunia.com/advisories/44954

http://secunia.com/advisories/48577

http://security.gentoo.org/glsa/glsa-200912-01.xml

http://security.gentoo.org/glsa/glsa-201203-22.xml

http://security.gentoo.org/glsa/glsa-201406-32.xml

http://securitytracker.com/id?1023148

https://exchange.xforce.ibmcloud.com/vulnerabilities/54158

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E

https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535

https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html

http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1

http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1

http://support.apple.com/kb/HT4004

http://support.apple.com/kb/HT4170

http://support.apple.com/kb/HT4171

http://support.avaya.com/css/P8/documents/100070150

http://support.avaya.com/css/P8/documents/100081611

http://support.avaya.com/css/P8/documents/100114315

http://support.avaya.com/css/P8/documents/100114327

http://support.citrix.com/article/CTX123359

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html

http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html

http://ubuntu.com/usn/usn-923-1

http://wiki.rpath.com/Advisories:rPSA-2009-0155

http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848

http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054

http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055

http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247

http://www-01.ibm.com/support/docview.wss?uid=swg21426108

http://www-01.ibm.com/support/docview.wss?uid=swg21432298

http://www-01.ibm.com/support/docview.wss?uid=swg24006386

http://www-01.ibm.com/support/docview.wss?uid=swg24025312

http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only

http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml

http://www.debian.org/security/2009/dsa-1934

http://www.debian.org/security/2011/dsa-2141

http://www.debian.org/security/2015/dsa-3253

http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995

http://www.kb.cert.org/vuls/id/120541

http://www.mandriva.com/security/advisories?name=MDVSA-2010:076

http://www.mandriva.com/security/advisories?name=MDVSA-2010:084

http://www.mandriva.com/security/advisories?name=MDVSA-2010:089

http://www.mozilla.org/security/announce/2010/mfsa2010-22.html

http://www.openssl.org/news/secadv_20091111.txt

http://www.openwall.com/lists/oss-security/2009/11/05/3

http://www.openwall.com/lists/oss-security/2009/11/05/5

http://www.openwall.com/lists/oss-security/2009/11/06/3

http://www.openwall.com/lists/oss-security/2009/11/07/3

http://www.openwall.com/lists/oss-security/2009/11/20/1

http://www.openwall.com/lists/oss-security/2009/11/23/10

http://www.opera.com/docs/changelogs/unix/1060/

http://www.opera.com/support/search/view/944/

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html

http://www.redhat.com/support/errata/RHSA-2010-0119.html

http://www.redhat.com/support/errata/RHSA-2010-0130.html

http://www.redhat.com/support/errata/RHSA-2010-0155.html

http://www.redhat.com/support/errata/RHSA-2010-0165.html

http://www.redhat.com/support/errata/RHSA-2010-0167.html

http://www.redhat.com/support/errata/RHSA-2010-0337.html

http://www.redhat.com/support/errata/RHSA-2010-0338.html

http://www.redhat.com/support/errata/RHSA-2010-0339.html

http://www.redhat.com/support/errata/RHSA-2010-0768.html

http://www.redhat.com/support/errata/RHSA-2010-0770.html

http://www.redhat.com/support/errata/RHSA-2010-0786.html

http://www.redhat.com/support/errata/RHSA-2010-0807.html

http://www.redhat.com/support/errata/RHSA-2010-0865.html

http://www.redhat.com/support/errata/RHSA-2010-0986.html

http://www.redhat.com/support/errata/RHSA-2010-0987.html

http://www.redhat.com/support/errata/RHSA-2011-0880.html

http://www.securitytracker.com/id?1023163

http://www.securitytracker.com/id?1023204

http://www.securitytracker.com/id?1023205

http://www.securitytracker.com/id?1023206

http://www.securitytracker.com/id?1023207

http://www.securitytracker.com/id?1023208

http://www.securitytracker.com/id?1023209

http://www.securitytracker.com/id?1023210

http://www.securitytracker.com/id?1023211

http://www.securitytracker.com/id?1023212

http://www.securitytracker.com/id?1023213

http://www.securitytracker.com/id?1023214

http://www.securitytracker.com/id?1023215

http://www.securitytracker.com/id?1023216

http://www.securitytracker.com/id?1023217

http://www.securitytracker.com/id?1023218

http://www.securitytracker.com/id?1023219

http://www.securitytracker.com/id?1023224

http://www.securitytracker.com/id?1023243

http://www.securitytracker.com/id?1023270

http://www.securitytracker.com/id?1023271

http://www.securitytracker.com/id?1023272

http://www.securitytracker.com/id?1023273

http://www.securitytracker.com/id?1023274

http://www.securitytracker.com/id?1023275

http://www.securitytracker.com/id?1023411

http://www.securitytracker.com/id?1023426

http://www.securitytracker.com/id?1023427

http://www.securitytracker.com/id?1023428

http://www.securitytracker.com/id?1024789

http://www.ubuntu.com/usn/USN-1010-1

http://www.ubuntu.com/usn/USN-927-1

http://www.ubuntu.com/usn/USN-927-4

http://www.ubuntu.com/usn/USN-927-5

http://www.us-cert.gov/cas/techalerts/TA10-222A.html

http://www.us-cert.gov/cas/techalerts/TA10-287A.html

http://www.vmware.com/security/advisories/VMSA-2010-0019.html

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

http://www.vupen.com/english/advisories/2009/3164

http://www.vupen.com/english/advisories/2009/3165

http://www.vupen.com/english/advisories/2009/3205

http://www.vupen.com/english/advisories/2009/3220

http://www.vupen.com/english/advisories/2009/3310

http://www.vupen.com/english/advisories/2009/3313

http://www.vupen.com/english/advisories/2009/3353

http://www.vupen.com/english/advisories/2009/3354

http://www.vupen.com/english/advisories/2009/3484

http://www.vupen.com/english/advisories/2009/3521

http://www.vupen.com/english/advisories/2009/3587

http://www.vupen.com/english/advisories/2010/0086

http://www.vupen.com/english/advisories/2010/0173

http://www.vupen.com/english/advisories/2010/0748

http://www.vupen.com/english/advisories/2010/0848

http://www.vupen.com/english/advisories/2010/0916

http://www.vupen.com/english/advisories/2010/0933

http://www.vupen.com/english/advisories/2010/0982

http://www.vupen.com/english/advisories/2010/0994

http://www.vupen.com/english/advisories/2010/1054

http://www.vupen.com/english/advisories/2010/1107

http://www.vupen.com/english/advisories/2010/1191

http://www.vupen.com/english/advisories/2010/1350

http://www.vupen.com/english/advisories/2010/1639

http://www.vupen.com/english/advisories/2010/1673

http://www.vupen.com/english/advisories/2010/1793

http://www.vupen.com/english/advisories/2010/2010

http://www.vupen.com/english/advisories/2010/2745

http://www.vupen.com/english/advisories/2010/3069

http://www.vupen.com/english/advisories/2010/3086

http://www.vupen.com/english/advisories/2010/3126

http://www.vupen.com/english/advisories/2011/0032

http://www.vupen.com/english/advisories/2011/0033

http://www.vupen.com/english/advisories/2011/0086

Details

Risk Information

CVSS v2