Actu
Vigil@nce - OpenSSL: using disabled SSLv2 ciphers
February 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can connect to a SSLv2 server with disabled ciphers in
OpenSSL, in order to create a TLS session which is not secure.
Impacted products: Cisco IPS, Cisco Nexus, NX-OS, Cisco CUCM,
Cisco Manager Attendant Console, Cisco IP Phone, BIG-IP Hardware,
TMOS, Fedora, FreeBSD, Copssh, Data ONTAP, OpenSSL, openSUSE,
Puppet, Slackware, stunnel, VxWorks.
Severity: 1/4.
Creation date: 28/01/2016.
DESCRIPTION OF THE VULNERABILITY
The OpenSSL library disables by default SSLv2, excepted if the
SSL_OP_NO_SSLv2 option is used.
SSLv2 cipher algorithms can be disabled on the server. However, a
malicious client can still use these algorithms.
An attacker can therefore connect to a SSLv2 server with disabled
ciphers in OpenSSL, in order to create a TLS session which is not
secure.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/OpenSSL-using-disabled-SSLv2-ciphers-18837
