Oracle Java SE and Java for Business contains a flaw related to the JSSE component. The application fails to properly associate renegotiation handshakes with an existing connection, allowing a MiTM attacker to use an unauthenticated request to insert data into HTTPS sessions, related to a 'plaintext injection' attack

Currently, there are no known workarounds or upgrades to correct this issue. However, Sun has released a patch to address this vulnerability.

• CVE ID: 2009-3555 (see also: NVD)
• Secunia Advisory ID: 41791 41905 41972 43091 49035 49966 51766
• Vendor Specific News/Changelog Entry: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03298151
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00008.html
  http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
• Vendor Specific Advisory URL: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03405642
  http://support.apple.com/kb/HT4417
  http://support.apple.com/kb/HT4418
  http://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2012-11-767
  http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html
  http://www.ubuntu.com/usn/usn-1010-1
• Packet Storm: http://packetstormsecurity.org/files/111920/HP-Security-Bulletin-HPSBOV02762-SSRT100825.html
• Mail List Post: http://seclists.org/bugtraq/2012/Apr/114

• Not Available