Vulnerability Note VU#120541
SSL and TLS protocols renegotiation vulnerability
A vulnerability exists in SSL and TLS protocols that may allow attackers to execute an arbitrary HTTP transaction.
The Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols are commonly used to provide authentication, encryption, integrity, and non-repudiation services to network applications such as HTTP, IMAP, POP3, LDAP. A vulnerability in the way SSL and TLS protocols allow renegotiation requests may allow an attacker to inject plaintext into an application protocol stream. This could result in a situation where the attacker may be able to issue commands to the server that appear to be coming from a legitimate source. According to the Network Working Group:
The server treats the client's initial TLS handshake as a renegotiation and thus believes that the initial data transmitted by the attacker is from the same entity as the subsequent client data.
A remote, unauthenticated attacker may be able to inject an arbitrary amount of chosen plaintext into the beginning of the application protocol stream. This could allow and attacker to issue HTTP requests, or take action impersonating the user, among other consequences.
Users should contact vendors for specific patch information.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Barracuda Networks||Affected||05 Nov 2009||17 Dec 2009|
|Debian GNU/Linux||Affected||05 Nov 2009||11 Nov 2009|
|GnuTLS||Affected||05 Nov 2009||11 Nov 2009|
|Hewlett-Packard Company||Affected||05 Nov 2009||17 Dec 2009|
|IBM Corporation||Affected||05 Nov 2009||11 Nov 2009|
|McAfee||Affected||05 Nov 2009||11 Nov 2009|
|Sun Microsystems, Inc.||Affected||05 Nov 2009||06 Nov 2009|
|Cryptlib||Not Affected||05 Nov 2009||11 Nov 2009|
|Force10 Networks, Inc.||Not Affected||05 Nov 2009||22 Jul 2011|
|libgcrypt||Not Affected||05 Nov 2009||11 Nov 2009|
|Redback Networks, Inc.||Not Affected||05 Nov 2009||11 Nov 2009|
|SafeNet||Not Affected||05 Nov 2009||19 Nov 2009|
|3com Inc||Unknown||05 Nov 2009||05 Nov 2009|
|ACCESS||Unknown||05 Nov 2009||05 Nov 2009|
|Alcatel-Lucent||Unknown||05 Nov 2009||05 Nov 2009|
CVSS Metrics (Learn More)
Thanks to Marsh Ray of PhoneFactor for reporting this vulnerability. This issue was also independently discovered and publicly disclosed by Martin Rex of SAP.
This document was written by Chris Taschner.
- CVE IDs: CVE-2009-3555
- Date Public: 05 Nov 2009
- Date First Published: 11 Nov 2009
- Date Last Updated: 22 Jul 2011
- Document Revision: 35
If you have feedback, comments, or additional information about this vulnerability, please send us email.