Rapid7 Vulnerability & Exploit Database

TLS Session Renegotiation Vulnerability

Back to Search

TLS Session Renegotiation Vulnerability

Severity
6
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:P)
Published
11/04/2009
Created
07/25/2018
Added
01/22/2010
Modified
02/07/2018

Description

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack.

Solution(s)

  • http-openssl-0_9_8-upgrade-0_9_8_m
  • tls-disable-renegotiation
  • WINDOWS-HOTFIX-MS10-049-1a3d0e85-3483-4cb8-a5f4-8fe7b5eca583
  • WINDOWS-HOTFIX-MS10-049-c5fb98a6-4676-4a30-b90a-742e9b1b8642
  • WINDOWS-HOTFIX-MS10-049-8d457f8d-9dd1-42bc-814b-f0e70a77739a
  • WINDOWS-HOTFIX-MS10-049-264a7caf-7e0b-4ec6-ba1d-1d026d399c07
  • WINDOWS-HOTFIX-MS10-049-a8dba517-a2b0-46db-9c6f-663987d610cd
  • WINDOWS-HOTFIX-MS10-049-cf022cdd-cccf-4a1a-a8e5-385a6d90d2d1
  • WINDOWS-HOTFIX-MS10-049-a9a5d9f8-63b5-434a-89bb-3e4c5e688b68
  • WINDOWS-HOTFIX-MS10-049-3e336a1d-5976-4614-aed2-38806afac3d0
  • WINDOWS-HOTFIX-MS10-049-996c4d91-7321-4c1d-86b4-1c5e4483c6ce
  • WINDOWS-HOTFIX-MS10-049-708a02a2-cde4-4328-b445-075e5a2d5202
  • WINDOWS-HOTFIX-MS10-049-9d1c7c90-ba1b-4c95-9ec5-d730d5c6433b
  • WINDOWS-HOTFIX-MS10-049-ab91b4d3-104d-4b93-8567-94da3be9491b
  • WINDOWS-HOTFIX-MS10-049-bf8cb00f-db33-4cab-aabb-0b9d7629391a
  • WINDOWS-HOTFIX-MS10-049-ac8f2b64-089c-4eea-87b4-5d381fba496e
  • WINDOWS-HOTFIX-MS10-049-c5b97407-6178-495b-b6de-45b32b310ef7
  • WINDOWS-HOTFIX-MS10-049-f4820b42-23e4-4789-b31a-50bf6f466eeb

References

View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;