CVE-2010-4180
Publicada em · Atualizada em
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 9.5%
probabilidade de exploração
9.5%top 5% das CVEs
exploração observada
nãonenhuma fonte reporta
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.
Produtos afetados
n/a · n/aReferências
http://cvs.openssl.org/chngview?cn=20131http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.htmlhttp://marc.info/?l=bugtraq&m=129916880600544&w=2http://marc.info/?l=bugtraq&m=130497251507577&w=2http://marc.info/?l=bugtraq&m=132077688910227&w=2