Oracle Supply Chain contains a flaw related to the Transportation Management component. The component fails to properly associate renegotiation handshakes with an existing connection, allowing a man-in-the-middle attacker to insert data into HTTPS sessions, and possibly other sessions which are protected by TLS or SSL. The issue is triggered when a remote attacker sends an unauthenticated request which is processed retroactively by the server in a post-renegotiation context, related to a plaintext injection attack.

Currently, there are no known workarounds or upgrades to correct this issue. However, Oracle has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.

• CVE ID: 2009-3555 (see also: NVD)
• Secunia Advisory ID: 41782 43091 49035 49966 51766
• Related OSVDB ID: 70054
• Vendor Specific News/Changelog Entry: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03298151
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00008.html
  http://www.gentoo.org/security/en/glsa/glsa-201301-01.xml
• Vendor Specific Advisory URL: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03405642
  http://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2012-11-767
  http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
• Packet Storm: http://packetstormsecurity.org/files/111920/HP-Security-Bulletin-HPSBOV02762-SSRT100825.html
• Mail List Post: http://seclists.org/bugtraq/2012/Apr/114
• News Article: http://www.networkworld.com/news/2010/101110-oracle-security-gaps.html
  http://www.scmagazineus.com/oracle-issues-massive-quarterly-update-with-java-fixes/article/180943/

• Not Available