PolarSSL Weak Signature Algorithm Negotiation

Medium Nessus Plugin ID 80399


The remote TLS server negotiates a weaker signature algorithm.


PolarSSL 1.3.8 does not properly negotiate the signature algorithm to use, allowing remote attackers to conduct downgrade attacks.

This plugin sends a list of hash algorithms (SHA512, SHA384, SHA256, SHA224, SHA1, and MD5) in descending order, and checks if the server selects MD5.


Use a PolarSSL version other than 1.3.8.

See Also



Plugin Details

Severity: Medium

ID: 80399

File Name: polarssl_cve-2014-8627.nasl

Version: $Revision: 1.2 $

Type: remote

Family: General

Published: 2015/01/07

Modified: 2015/01/09

Dependencies: 56984

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:polarssl:polarssl

Required KB Items: SSL/Supported

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/11/22

Vulnerability Publication Date: 2014/11/22

Reference Information

CVE: CVE-2014-8627

BID: 70902

OSVDB: 114148