National Cyber-Alert System

Vulnerability Summary for CVE-2005-2969

Overview

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://www.openssl.org/news/secadv_20051011.txt

Type: Advisory; Patch Information

Hyperlink:http://www.openssl.org/news/secadv_20051011.txt

External Source: BID

Name: 15647

Hyperlink:http://www.securityfocus.com/bid/15647

External Source: BID

Name: 15071

Hyperlink:http://www.securityfocus.com/bid/15071

External Source: REDHAT

Name: RHSA-2008:0629

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0629.html

External Source: REDHAT

Name: RHSA-2005:800

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-800.html

External Source: REDHAT

Name: RHSA-2005:762

Hyperlink:http://www.redhat.com/support/errata/RHSA-2005-762.html

External Source: SUSE

Name: SUSE-SA:2005:061

Hyperlink:http://www.novell.com/linux/security/advisories/2005_61_openssl.html

External Source: MANDRIVA

Name: MDKSA-2005:179

Hyperlink:http://www.mandriva.com/security/advisories?name=MDKSA-2005:179

External Source: MISC

Name: http://www.juniper.net/support/security/alerts/PSN-2005-12-025.txt

Hyperlink:http://www.juniper.net/support/security/alerts/PSN-2005-12-025.txt

External Source: VUPEN

Name: ADV-2005-3056

Hyperlink:http://www.frsirt.com/english/advisories/2005/3056

External Source: VUPEN

Name: ADV-2005-3002

Hyperlink:http://www.frsirt.com/english/advisories/2005/3002

External Source: VUPEN

Name: ADV-2005-2908

Hyperlink:http://www.frsirt.com/english/advisories/2005/2908

External Source: VUPEN

Name: ADV-2005-2710

Hyperlink:http://www.frsirt.com/english/advisories/2005/2710

External Source: VUPEN

Name: ADV-2005-2659

Hyperlink:http://www.frsirt.com/english/advisories/2005/2659

External Source: VUPEN

Name: ADV-2005-2036

Hyperlink:http://www.frsirt.com/english/advisories/2005/2036

External Source: DEBIAN

Name: DSA-882

Hyperlink:http://www.debian.org/security/2005/dsa-882

External Source: DEBIAN

Name: DSA-881

Hyperlink:http://www.debian.org/security/2005/dsa-881

External Source: DEBIAN

Name: DSA-875

Hyperlink:http://www.debian.org/security/2005/dsa-875

External Source: CISCO

Name: 20051202 Cisco Security Notice: Response to OpenSSL - Potential SSL 2.0 Rollback

Hyperlink:http://www.cisco.com/warp/public/707/cisco-response-20051202-openssl.shtml

External Source: MISC

Name: http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754

Hyperlink:http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-031.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-031.htm

External Source: SECTRACK

Name: 1015032

Hyperlink:http://securitytracker.com/id?1015032

External Source: SECUNIA

Name: 31492

Hyperlink:http://secunia.com/advisories/31492

External Source: SECUNIA

Name: 19185

Hyperlink:http://secunia.com/advisories/19185

External Source: SECUNIA

Name: 18663

Hyperlink:http://secunia.com/advisories/18663

External Source: SECUNIA

Name: 18165

Hyperlink:http://secunia.com/advisories/18165

External Source: SECUNIA

Name: 18123

Hyperlink:http://secunia.com/advisories/18123

External Source: SECUNIA

Name: 18045

Hyperlink:http://secunia.com/advisories/18045

External Source: SECUNIA

Name: 17888

Hyperlink:http://secunia.com/advisories/17888

External Source: SECUNIA

Name: 17813

Hyperlink:http://secunia.com/advisories/17813

External Source: SECUNIA

Name: 17632

Hyperlink:http://secunia.com/advisories/17632

External Source: SECUNIA

Name: 17617

Hyperlink:http://secunia.com/advisories/17617

External Source: SECUNIA

Name: 17589

Hyperlink:http://secunia.com/advisories/17589

External Source: SECUNIA

Name: 17466

Hyperlink:http://secunia.com/advisories/17466

External Source: SECUNIA

Name: 17432

Hyperlink:http://secunia.com/advisories/17432

External Source: SECUNIA

Name: 17409

Hyperlink:http://secunia.com/advisories/17409

External Source: SECUNIA

Name: 17389

Hyperlink:http://secunia.com/advisories/17389

External Source: SECUNIA

Name: 17344

Hyperlink:http://secunia.com/advisories/17344

External Source: SECUNIA

Name: 17335

Hyperlink:http://secunia.com/advisories/17335

External Source: SECUNIA

Name: 17288

Hyperlink:http://secunia.com/advisories/17288

External Source: SECUNIA

Name: 17259

Hyperlink:http://secunia.com/advisories/17259

External Source: SECUNIA

Name: 17210

Hyperlink:http://secunia.com/advisories/17210

External Source: SECUNIA

Name: 17191

Hyperlink:http://secunia.com/advisories/17191

External Source: SECUNIA

Name: 17189

Hyperlink:http://secunia.com/advisories/17189

External Source: SECUNIA

Name: 17180

Hyperlink:http://secunia.com/advisories/17180

External Source: SECUNIA

Name: 17178

Hyperlink:http://secunia.com/advisories/17178

External Source: SECUNIA

Name: 17169

Hyperlink:http://secunia.com/advisories/17169

External Source: SECUNIA

Name: 17153

Hyperlink:http://secunia.com/advisories/17153

External Source: SECUNIA

Name: 17151

Hyperlink:http://secunia.com/advisories/17151

External Source: SECUNIA

Name: 17146

Hyperlink:http://secunia.com/advisories/17146

External Source: TRUSTIX

Name: TSLSA-2005-0059

Hyperlink:http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html

External Source: APPLE

Name: APPLE-SA-2005-11-29

Hyperlink:http://docs.info.apple.com/article.html?artnum=302847

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-1633

Hyperlink:https://issues.rpath.com/browse/RPL-1633

External Source: XF

Name: hitachi-hicommand-security-bypass(35287)

Hyperlink:http://xforce.iss.net/xforce/xfdb/35287

External Source: BID

Name: 24799

Hyperlink:http://www.securityfocus.com/bid/24799

External Source: CONFIRM

Name: http://www.hitachi-support.com/security_e/vuls_e/HS07-016_e/index-e.html

Hyperlink:http://www.hitachi-support.com/security_e/vuls_e/HS07-016_e/index-e.html

External Source: CONFIRM

Name: http://www.hitachi-support.com/security_e/vuls_e/HS06-022_e/01-e.html

Hyperlink:http://www.hitachi-support.com/security_e/vuls_e/HS06-022_e/01-e.html

External Source: VUPEN

Name: ADV-2007-2457

Hyperlink:http://www.frsirt.com/english/advisories/2007/2457

External Source: VUPEN

Name: ADV-2007-0343

Hyperlink:http://www.frsirt.com/english/advisories/2007/0343

External Source: VUPEN

Name: ADV-2007-0326

Hyperlink:http://www.frsirt.com/english/advisories/2007/0326

External Source: VUPEN

Name: ADV-2006-3531

Hyperlink:http://www.frsirt.com/english/advisories/2006/3531

External Source: CONFIRM

Name: http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm

Hyperlink:http://support.avaya.com/elmodocs2/security/ASA-2006-260.htm

External Source: SUNALERT

Name: 101974

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101974-1

External Source: SECUNIA

Name: 26893

Hyperlink:http://secunia.com/advisories/26893

External Source: SECUNIA

Name: 25973

Hyperlink:http://secunia.com/advisories/25973

External Source: SECUNIA

Name: 23915

Hyperlink:http://secunia.com/advisories/23915

External Source: SECUNIA

Name: 23843

Hyperlink:http://secunia.com/advisories/23843

External Source: SECUNIA

Name: 23340

Hyperlink:http://secunia.com/advisories/23340

External Source: SECUNIA

Name: 23280

Hyperlink:http://secunia.com/advisories/23280

External Source: SECUNIA

Name: 21827

Hyperlink:http://secunia.com/advisories/21827

External Source: HP

Name: SSRT071299

Hyperlink:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00849540

External Source: HP

Name: HPSBUX02174

Hyperlink:http://itrc.hp.com/service/cki/docDisplay.do?docId=c00805100

External Source: MISC

Name: ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers/dir5.10.3_docs_relnotes.pdf

Hyperlink:ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers/dir5.10.3_docs_relnotes.pdf