OSVDB ID: 61234

Title: IBM SDK for Java TLS Renegotiation Handshakes MiTM Plaintext Data Injection

Info

Disclosure

Dec 18, 2009

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Classification

Location: Remote / Network Access
Attack Type: Cryptographic, Information Disclosure, Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Solution: Patch / RCS
Disclosure: Vendor Verified

Solution

Products

Unknown or Incomplete

References

Security Tracker: 1023148 1023163 1023204 1023205 1023206 1023207 1023208 1023209 1023210 1023211 1023212 1023215 1023216 1023217 1023218 1023219 1023243 1023270 1023271 1023272 1023273 1023274 1023275
CERT VU: 120541
CVE ID: 2009-3555 (see also: NVD)
Bugtraq ID: 36935
Secunia Advisory ID: 37291 37292 37320 37501 37504 37656 37675 37875 37968 38020 38069 38241 38483 38781 38813 39089 39207 39210 39216 39294 39317 39956 39967 43091 49035 49966 51766
ISS X-Force ID: 54158
Related OSVDB ID: 60521
VUPEN Advisory: ADV-2009-3164 ADV-2009-3165 ADV-2009-3205 ADV-2009-3220 ADV-2009-3353 ADV-2009-3354
Other Advisory URL: http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html
http://clicky.me/tlsvuln
http://extendedsubset.com/?p=8
http://extendedsubset.com/Renegotiating_TLS.pdf
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686
http://openbsd.org/errata45.html#010_openssl
http://openbsd.org/errata46.html#004_openssl
http://www.betanews.com/article/1257452450
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml
http://www.debian.org/security/2009/dsa-1934
http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html
http://www.ietf.org/mail-archive/web/tls/current/msg03928.html
http://www.ietf.org/mail-archive/web/tls/current/msg03948.html
http://www.links.org/?p=780
http://www.links.org/?p=786
http://www.links.org/?p=789
http://www.openwall.com/lists/oss-security/2009/11/05/3
http://www.openwall.com/lists/oss-security/2009/11/05/5
http://www.openwall.com/lists/oss-security/2009/11/06/3
http://www.openwall.com/lists/oss-security/2009/11/07/3
http://www.openwall.com/lists/oss-security/2009/11/20/1
http://www.openwall.com/lists/oss-security/2009/11/23/10
http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html
http://www.tombom.co.uk/blog/?p=85
https://bugzilla.mozilla.org/show_bug.cgi?id=526689
https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html
https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt
Vendor Specific News/Changelog Entry: http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03298151
http://kbase.redhat.com/faq/docs/DOC-20491
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/034817.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035949.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041887.html
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00008.html
http://support.citrix.com/article/CTX123359
http://sysoev.ru/nginx/patch.cve-2009-3555.txt
http://wiki.rpath.com/Advisories:rPSA-2009-0155
http://www-01.ibm.com/support/docview.wss?uid=swg21415080
http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
http://www.ingate.com/Relnote.php?ver=481
https://bugzilla.redhat.com/show_bug.cgi?id=533125
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01360.html
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01418.html
Vendor Specific Advisory URL: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03405642
http://support.apple.com/kb/HT4004
http://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2012-11-767
Mail List Post: http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html
http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2
http://marc.info/?l=cryptography&m=125752275331877&w=2
http://seclists.org/bugtraq/2012/Apr/114
http://seclists.org/fulldisclosure/2009/Nov/139
http://www.securityfocus.com/archive/1/archive/1/507952/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/508075/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/508130/100/0/threaded
Packet Storm: http://packetstormsecurity.org/files/111920/HP-Security-Bulletin-HPSBOV02762-SSRT100825.html
RedHat RHSA: http://rhn.redhat.com/errata/RHSA-2010-0165.html
https://rhn.redhat.com/errata/RHSA-2010-0011.html
https://rhn.redhat.com/errata/RHSA-2010-0130.html
https://rhn.redhat.com/errata/RHSA-2010-0337.html
https://rhn.redhat.com/errata/RHSA-2010-0338.html
https://rhn.redhat.com/errata/RHSA-2010-0339.html
Vendor Specific Solution URL: http://security.gentoo.org/glsa/glsa-200912-01.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/61234