CVE-2010-4180

Опубликовано: 06 дек. 2010

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

Ссылки

http://cvs.openssl.org/chngview?cn=20131
Broken Link
Patch
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777
Broken Link
http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
Broken Link
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=129916880600544&w=2
Issue Tracking
Third Party Advisory
http://marc.info/?l=bugtraq&m=130497251507577&w=2
Issue Tracking
Third Party Advisory
http://marc.info/?l=bugtraq&m=132077688910227&w=2
Issue Tracking
Third Party Advisory
http://openssl.org/news/secadv_20101202.txt
Patch
Third Party Advisory
http://osvdb.org/69565
Broken Link
http://secunia.com/advisories/42469
Not Applicable
http://secunia.com/advisories/42473
Not Applicable
http://secunia.com/advisories/42493
Not Applicable
http://secunia.com/advisories/42571
Not Applicable
http://secunia.com/advisories/42620
Not Applicable
http://secunia.com/advisories/42811
Not Applicable

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Версия до 0.9.8q (исключая)

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Версия от 1.0.0 (включая) до 1.0.0c (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:11.0:sp1:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:-:*:*:*

Конфигурация 6

cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*

Версия до 0.9.2 (исключая)

EPSS

Процентиль: 88%

0.03846

Низкий

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

CVE-2010-4180

ubuntu

около 15 лет назад

CVE-2010-4180

redhat

около 15 лет назад

CVE-2010-4180

debian

около 15 лет назад

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_R ...

GHSA-hvp6-pw37-63wh

github

больше 3 лет назад

ELSA-2010-0979

oracle-oval

почти 15 лет назад

ELSA-2010-0979: openssl security update (MODERATE)

EPSS

Процентиль: 88%

0.03846

Низкий

4.3 Medium

CVSS2

Дефекты

NVD-CWE-noinfo