SSL / TLS Renegotiation DoS
medium Nessus Plugin ID 53491
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The remote service allows repeated renegotiation of TLS / SSL connections.Description
The remote service encrypts traffic using TLS / SSL and permits clients to renegotiate connections. The computational requirements for renegotiating a connection are asymmetrical between the client and the server, with the server performing several times more work. Since the remote host does not appear to limit the number of renegotiations for a single TLS / SSL connection, this permits a client to open several simultaneous connections and repeatedly renegotiate them, possibly leading to a denial of service condition.Solution
Contact the vendor for specific patch information.See Also
http://www.ietf.org/mail-archive/web/tls/current/msg07553.html
Plugin Details
Severity: Medium
ID: 53491
File Name: ssl_renegotiation_dos.nasl
Version: 1.17
Type: remote
Family: General
Published: 5/4/2011
Updated: 10/18/2013
Dependencies: ssl_supported_versions.nasl
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.9
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P
Temporal Vector: E:POC/RL:U/RC:C
Vulnerability Information
Required KB Items: SSL/Supported
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 3/13/2011
Reference Information
CVE: CVE-2011-1473
BID: 48626
OSVDB: 73894