Rapid7 VulnDB

JRE Java TLS Renegotiation Vulnerability

Back to Search

JRE Java TLS Renegotiation Vulnerability

Severity
6
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:P)
Published
11/09/2009
Created
07/25/2018
Added
04/02/2010
Modified
09/13/2018

Description

The TLS protocol as well as the SSL protocol 3.0 and possibly earlier do not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. This affects Java 6 update 18, Java 5.0 update 23 and Java 1.4.2_25.

Solution(s)

  • jre-upgrade-latest

References

  • jre-upgrade-latest

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;