jvndb-2014-000048
Vulnerability from jvndb
Published
2014-06-06 13:48
Modified
2016-12-27 11:49
Severity ?
() - -
Summary
OpenSSL improper handling of Change Cipher Spec message
Details
OpenSSL improperly handles Change Cipher Spec message in the initial SSL/TLS handshake. OpenSSL contains a flaw in the implementation of the Change Cipher Spec protocol that allows a MITM (man-in-the-middle) attacker to force a server and a client to use easily guessable cryptgraphic key material during the initial SSL/TLS handshake (CWE-325). KIKUCHI Masashi of Lepidum Co. Ltd. reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
JVN http://jvn.jp/en/jp/JVN61247051/index.html
JVN http://jvn.jp/vu/JVNVU93868849/index.html
CVE //cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224
NVD http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0224
IPA SECURITY ALERTS http://www.ipa.go.jp/security/ciadr/vul/20140606-jvn.html
CERT-VN http://www.kb.cert.org/vuls/id/978508
ICS-CERT ADVISORY http://ics-cert.us-cert.gov/advisories/ICSA-14-156-01
ICS-CERT ADVISORY https://ics-cert.us-cert.gov/advisories/ICSA-14-198-03
CERT-FI https://www.cert.fi/haavoittuvuudet/2014/haavoittuvuus-2014-075.html
Related document https://plus.google.com/app/basic/stream/z12xhp3hbzbhhjgfm22ncvtbeua1dpaa004
Related document http://ccsinjection.lepidum.co.jp/
Related document http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html
Related document http://www.aratana.jp/security/detail.php?id=9
IETF http://tools.ietf.org/html/rfc5246#section-7.1
No Mapping(CWE-Other) https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
Impacted products
OpenSSL ProjectOpenSSL
Show details on JVN DB website

To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000048.html",
  "dc:date": "2016-12-27T11:49+09:00",
  "dcterms:issued": "2014-06-06T13:48+09:00",
  "dcterms:modified": "2016-12-27T11:49+09:00",
  "description": "OpenSSL improperly handles Change Cipher Spec message in the initial SSL/TLS handshake.\r\n\r\nOpenSSL contains a flaw in the implementation of the Change Cipher Spec protocol that allows a MITM (man-in-the-middle) attacker to force a server and a client to use easily guessable cryptgraphic key material during the initial SSL/TLS handshake (CWE-325).\r\n\r\nKIKUCHI Masashi of Lepidum Co. Ltd. reported this vulnerability to JPCERT/CC.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2014/JVNDB-2014-000048.html",
  "sec:cpe": {
    "#text": "cpe:/a:openssl:openssl",
    "@product": "OpenSSL",
    "@vendor": "OpenSSL Project",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.0",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2014-000048",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN61247051/index.html",
      "@id": "JVN#61247051",
      "@source": "JVN"
    },
    {
      "#text": "http://jvn.jp/vu/JVNVU93868849/index.html",
      "@id": "JVNVU#93868849",
      "@source": "JVN"
    },
    {
      "#text": "//cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224",
      "@id": "CVE-2014-0224",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0224",
      "@id": "CVE-2014-0224",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/ciadr/vul/20140606-jvn.html",
      "@id": "Security Alert for OpenSSL improper handling of Change Cipher Spec message (JVN#61247051)",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://www.kb.cert.org/vuls/id/978508",
      "@id": "VU#978508",
      "@source": "CERT-VN"
    },
    {
      "#text": "http://ics-cert.us-cert.gov/advisories/ICSA-14-156-01",
      "@id": "ICSA-14-156-01",
      "@source": "ICS-CERT ADVISORY"
    },
    {
      "#text": "https://ics-cert.us-cert.gov/advisories/ICSA-14-198-03",
      "@id": "ICSA-14-198-03",
      "@source": "ICS-CERT ADVISORY"
    },
    {
      "#text": "https://www.cert.fi/haavoittuvuudet/2014/haavoittuvuus-2014-075.html",
      "@id": "Haavoittuvuuksia OpenSSL-kirjastossa",
      "@source": "CERT-FI"
    },
    {
      "#text": "https://plus.google.com/app/basic/stream/z12xhp3hbzbhhjgfm22ncvtbeua1dpaa004",
      "@id": "Here is the timeline from my (OpenSSL) perspective for the recent CCS Injection (MITM) vulnerability as well as the other flaws being fixed today",
      "@source": "Related document"
    },
    {
      "#text": "http://ccsinjection.lepidum.co.jp/",
      "@id": "CCS Injection Vulnerability",
      "@source": "Related document"
    },
    {
      "#text": "http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html",
      "@id": "How I discovered CCS Injection Vulnerability (CVE-2014-0224)",
      "@source": "Related document"
    },
    {
      "#text": "http://www.aratana.jp/security/detail.php?id=9",
      "@id": "Announcement of Aratana",
      "@source": "Related document"
    },
    {
      "#text": "http://tools.ietf.org/html/rfc5246#section-7.1",
      "@id": "Change Cipher Spec",
      "@source": "IETF"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "OpenSSL improper handling of Change Cipher Spec message"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.