CERT-In Advisory
CIAD-2009-0056
SSL and TLS protocols renegotiation vulnerability
Original Issue Date: December 09, 2009
Severity Rating: High
Systems Affected
- Multiple implementations of SSL and TLS protocols
Overview
A vulnerability exists in SSL and TLS protocols that may allow attackers to execute an arbitrary HTTPS transaction.
Description
TLS Transport Layer Security and SSL Secure Sockets Layer are most widely recognized as the protocols that provide secure HTTP HTTPS for Internet transactions between Web browsers and Web servers. TLS/SSL can also be used for other application level protocols, such as File Transfer Protocol FTP , Lightweight Directory Access Protocol LDAP , and Simple Mail Transfer Protocol SMTP . TLS/SSL enables server authentication, client authentication, data encryption, and data integrity over networks such as the World Wide Web.
A vulnerability has been identified in the current SSL Version 3 and TLS Version 1 protocols while handling TLS handshake re-negotiations. An attacker could exploit this vulnerability via man-in-the-middle techniques and injecting data into the beginning of the application protocol stream. This could lead to fragmentation of SSL transactions, giving attackers the opportunity to inject false commands or to execute HTTP transactions such as password resets into communications which are otherwise encrypted. This attack can bypass authentication and possibly launch further attacks against the victim.
Solution
Apply appropriate patches or fixes released by respective vendors at server and client level.
Workaround
- Implement anti-CSRF Cross Site Request Forgery features in web applications.
- Use an IPS/IDS/Application firewall to catch recurrent HTTP request that are enclosed within each other.
Vendor Information
CISCO
http://www.cisco.com/warp/public/707/cisco-sa-20091109-tls.shtml
SUN
http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1
FREEBSD
http://security.freebsd.org/advisories/FreeBSD-SA-09:15.ssl.asc
HP
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?
IBM ISS
http://www.iss.net/threats/352.html
REDHAT
https://rhn.redhat.com/errata/RHSA-2009-1579.html
DEBIAN
http://www.debian.org/security/2009/dsa-1934
SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html
References
US-CERT
http://www.kb.cert.org/vuls/id/120541
ISS X FORCE
http://xforce.iss.net/xforce/xfdb/54158
SecurityFocus
http://www.securityfocus.com/bid/36935
IETF
http://www.ietf.org/mail-archive/web/tls/current/msg03942.html
JUNIPER NET
http://forums.juniper.net/t5/Networking-Now/Transport-Security-Layer-TLS-Man-In-The-Middle-Vulnerability/ba-p/29671;jsessionid=D50ECE971FB149421F0F2AB60C5B3AAC
CERT-In
http://www.cert-in.org.in/vulnerability/civn-2009-143.htm
CVE Name
CVE-2009-3555
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|