Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
OpenSSL 'ChangeCipherSpec' MiTM Potential Vulnerability
#1
I am using Intraweb 14.2.1 and the OpenSSL dll libraries 1.0.2u(last modified 21/12/2019). We received below vulnerability on this quarter PT on one of the web application running as standalone. How can resolve this issue please?


[The OpenSSL service on the remote host is potentially vulnerable to aman-in-the-middle (MiTM) attack based on its response to twoconsecutive 'ChangeCipherSpec' messages during the incorrect phase ofan SSL/TLS handshake.This flaw could allow a MiTM attacker to decrypt or forge SSL messagesby telling the service to begin encrypted communications before keymaterial has been exchanged which causes predictable keys to be usedto secure future traffic.OpenSSL 1.0.1 is known to be exploitable. OpenSSL 0.9.8 and 1.0.0 arenot known to be vulnerable; however the OpenSSL team has advised thatusers of these older versions upgrade as a precaution. This checkdetects and reports all versions of OpenSSL that are potentiallyexploitable.Note that Indusface WAS has only tested for an SSL/TLS MiTM vulnerability(CVE-2014-0224). However Indusface WAS has inferred that the OpenSSL serviceon the remote host is also affected by six additional vulnerabilitiesthat were disclosed in OpenSSL's June 5th 2014 security advisory : - An error exists in the 'ssl3_read_bytes' function that permits data to be injected into other sessions or allows denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2010-5298) - An error exists related to the implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) that allows nonce disclosure via the 'FLUSH+RELOAD' cache side-channel attack. (CVE-2014-0076) - A buffer overflow error exists related to invalid DTLS fragment handling that permits the execution of arbitrary code or allows denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client or server. (CVE-2014-0195) - An error exists in the 'do_ssl3_write' function that permits a NULL pointer to be dereferenced which could allow denial of service attacks. Note that this issue is exploitable only if SSL_MODE_RELEASE_BUFFERS is enabled. (CVE-2014-0198) - An error exists related to DTLS handshake handling that could allow denial of service attacks. Note that this issue only affects OpenSSL when used as a DTLS client. (CVE-2014-0221) - An error exists in the 'dtls1_get_message_fragment' function related to anonymous ECDH cipher suites. This could allow denial of service attacks. Note that this issue only affects OpenSSL TLS clients. (CVE-2014-3470)OpenSSL did not release individual patches for these vulnerabilitiesinstead they were all patched under a single version release. Notethat the service will remain vulnerable after patching until theservice or host is restarted.]
Reply


Messages In This Thread
OpenSSL 'ChangeCipherSpec' MiTM Potential Vulnerability - by pgnair - 12-17-2020, 10:26 AM

Forum Jump:


Users browsing this thread: 2 Guest(s)