Actu
Vigil@nce - OpenSSL: changing ciphersuite
December 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
When a server uses OpenSSL, a remote attacker can change the
ciphersuite, in order to force the usage of a weaker algorithm.
Severity: 2/4
Creation date: 03/12/2010
DESCRIPTION OF THE VULNERABILITY
The SSL session caching feature saves sessions, to be reused
later. An application can enable it with the
SSL_CTX_set_session_cache_mode() function. For example, Apache
httpd does not enable it.
The SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG flag allows a
ciphersuite change, to resolve a compatibility problem with old
Netscape web browsers.
However, when a server uses session caching and
SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG (or SSL_OP_ALL), a
malicious client can use this feature to choose a weaker algorithm
for the following sessions.
When a server uses OpenSSL, a remote attacker can therefore change
the ciphersuite, in order to force the usage of a weaker algorithm.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/OpenSSL-changing-ciphersuite-10173
