CVE-2009-3555
At a glance
- Source
- NVD
- EPSS
- EPSS 87.26 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Weaknesses (CWE)
References
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
- http://www.securitytracker.com/id?1023427
- http://support.avaya.com/css/P8/documents/100081611
- http://osvdb.org/62210
- http://secunia.com/advisories/37640
- http://www.arubanetworks.com/support/alerts/aid-020810.txt
- http://www.vupen.com/english/advisories/2010/0916
- http://support.avaya.com/css/P8/documents/100114327
- http://www.redhat.com/support/errata/RHSA-2010-0167.html
- http://www.vupen.com/english/advisories/2010/2010
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html
- http://www.vupen.com/english/advisories/2010/0086
- http://www.vupen.com/english/advisories/2010/1673
- http://www.ietf.org/mail-archive/web/tls/current/msg03948.html
- http://secunia.com/advisories/37656
- http://www.redhat.com/support/errata/RHSA-2010-0865.html
- http://secunia.com/advisories/39628
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
- http://secunia.com/advisories/42724
- http://www.vupen.com/english/advisories/2009/3310
- http://www.vupen.com/english/advisories/2009/3205
- http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during
- http://secunia.com/advisories/39461
- http://support.avaya.com/css/P8/documents/100114315
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.ingate.com/Relnote.php?ver=481
- http://www.securitytracker.com/id?1023204
- http://secunia.com/advisories/40866
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://www.us-cert.gov/cas/techalerts/TA10-222A.html
- http://www.securitytracker.com/id?1023211
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686
- http://secunia.com/advisories/39317
- http://www.securitytracker.com/id?1023212
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html
- http://secunia.com/advisories/39127
- http://secunia.com/advisories/40545
- http://www.vupen.com/english/advisories/2010/3069
- http://openbsd.org/errata45.html#010_openssl
- http://www.securitytracker.com/id?1023210
- http://www.securitytracker.com/id?1023270
- http://secunia.com/advisories/40070
- http://www.securitytracker.com/id?1023273
- http://kbase.redhat.com/faq/docs/DOC-20491
- http://www.ubuntu.com/usn/USN-927-5
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:089
- http://www.redhat.com/support/errata/RHSA-2010-0770.html
- +150 more
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | MEDIUM 5.8 | AV:N/AC:M/Au:N/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-f7w7-6pjc-wwm6 — Apache Tomcat affected by vulnerability in TLS and SSL protocol
European references
- ENISA EUVD · EUVD-2022-3720
- GCVE · GCVE-0-2009-3555
CERT-FR advisories
- CERTFR-2017-AVI-392 — Multiples vulnérabilités dans Fortinet FortiOS · cert.ssi.gouv.fr
- CERTA-2012-AVI-395 — Vulnérabilités dans HP Network Node Manager i · cert.ssi.gouv.fr
- CERTA-2012-AVI-241 — Multiples vulnérabilités dans HP SIM · cert.ssi.gouv.fr
- CERTA-2012-AVI-219 — Multiples vulnérabilités dans HP OpenVMS · cert.ssi.gouv.fr
- CERTA-2012-AVI-186 — Vulnérabilités dans HP Onboard Administrator · cert.ssi.gouv.fr
- CERTA-2012-AVI-023 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTA-2011-AVI-524 — Multiples vulnérabilités dans Blue Coat Director · cert.ssi.gouv.fr
- CERTA-2011-AVI-253 — Vulnérabilité dans Hitachi Web Server · cert.ssi.gouv.fr
- CERTA-2011-AVI-238 — Multiples Vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2011-AVI-221 — Multiples vulnérabilités dans Blackberry Enterprise Server · cert.ssi.gouv.fr
- CERTA-2011-AVI-132 — Vulnérabilités dans syslog-ng · cert.ssi.gouv.fr
- CERTA-2010-AVI-627 — Vulnérabilités dans Blue Coat Reporter · cert.ssi.gouv.fr
- CERTA-2010-AVI-583 — Multiples vulnérabilités dans VMware ESX · cert.ssi.gouv.fr
- CERTA-2010-AVI-573 — Multiples vulnérabilités dans les produits Hitachi Cosminexus · cert.ssi.gouv.fr
- CERTA-2010-AVI-513 — Multiples vulnérabilités dans Mac OS X Java · cert.ssi.gouv.fr
- CERTA-2010-AVI-499 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2010-AVI-461 — Multiples vulnérabilités dans VMware ESX Server · cert.ssi.gouv.fr
- CERTA-2010-AVI-365 — Vulnérabilités dans SSL/TLS et Secure Channel de Windows · cert.ssi.gouv.fr
- CERTA-2010-AVI-317 — Multiples vulnérabilités dans HP Insight · cert.ssi.gouv.fr
- CERTA-2010-AVI-314 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
- CERTA-2010-AVI-241 — Vulnérabilités dans OpenOffice.org · cert.ssi.gouv.fr
- CERTA-2010-AVI-239 — Vulnérabilités dans IBM DB2 · cert.ssi.gouv.fr
- CERTA-2010-AVI-217 — Multiples vulnérabilités Java de Mac OS X · cert.ssi.gouv.fr
- CERTA-2010-AVI-211 — Vulnérabilités dans le serveur HTTP d'IBM · cert.ssi.gouv.fr
- CERTA-2010-AVI-196 — Multiples vulnérabilités de IBM DB2 · cert.ssi.gouv.fr
- CERTA-2010-AVI-149 — Multiples vulnérabilités dans Firefox · cert.ssi.gouv.fr
- CERTA-2010-AVI-112 — Multiples vulnérabilités du serveur HTTP Apache · cert.ssi.gouv.fr
- CERTA-2010-AVI-022 — Multiples vulnérabilités dans Apple Mac OS X · cert.ssi.gouv.fr
- CERTA-2009-AVI-529 — Vulnérabilités dans IBM WebSphere · cert.ssi.gouv.fr
- CERTA-2009-AVI-528 — Multiples vulnérabilités des systèmes FreeBSD · cert.ssi.gouv.fr
- +1 more
Affected configurations (NVD CPE)
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*≤ 2.2.14cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:*≤ 2.8.5cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:*≤ 3.12.4cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≤ 0.9.8kcpe:2.3:a:openssl:openssl:1.0:*:openvms:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*≥ 0.1.0 ≤ 0.8.22
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |