Security Alerts

Secunia

Community Login

VIM Login

Partner Login

Overview

Advisories

Research

Forums

Create Profile

Our Commitment

Database

Advisories by Product

Advisories by Vendor

Terminology

Report Vulnerability

Insecure Library Loading

Secunia Advisory SA37604

IBM HTTP Server TLS Session Renegotiation Plaintext Injection

Secunia Advisory

SA37604

Get alerted and manage the vulnerability life cycle

Release Date

2009-12-07

Last Update

2010-03-30

Popularity

3,356 views

Comments

0 comments

Criticality level

Less critical

Impact

Manipulation of data

Where

From remote

Authentication level

Available in Customer Area

Report reliability

Available in Customer Area

Solution Status

Vendor Patch

Systems affected

Available in Customer Area

Approve distribution

Available in Customer Area

Software:

IBM HTTP Server 6.0.x

IBM HTTP Server 6.1.x

IBM HTTP Server 7.0.x

Secunia CVSS Score

Available in Customer Area

CVE Reference(s)

CVE-2009-3555 CVSS available in Customer Area

Description

IBM has acknowledged a vulnerability in IBM HTTP Server, which can be exploited by malicious people to manipulate certain data.

The vulnerability is caused due to an error in the TLS protocol while handling session renegotiations. This can be exploited via Man-in-the-Middle (MitM) attacks to insert arbitrary plaintext before data sent by a legitimate client in an existing TLS session.

The vulnerability is reported in version 6.0.2, 6.1, and 7.0.

Solution
Apply fixes.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
IBM (PM00675, II14533):
http://www-01.ibm.com/support/docview.wss?uid=swg24025312
http://www-01.ibm.com/support/docview.wss?uid=swg21413714
http://www-01.ibm.com/support/docview.wss?uid=nas258cbfcf0a5645af7862576710041f65e
http://www-01.ibm.com/support/docview.wss?uid=swg27014506

Deep Links
Links available in Customer Area

Do you have additional information related to this advisory?

Please provide information about patches, mitigating factors, new versions, exploits, faulty patches, links, and other relevant data by posting comments to this Advisory. You can also send this information to vuln@secunia.com

Subject: IBM HTTP Server TLS Session Renegotiation Plaintext Injection

No posts yet

Secunia Advisory SA37604

IBM HTTP Server TLS Session Renegotiation Plaintext Injection

Do you have additional information related to this advisory?

You must be logged in to post a comment.

Secunia Customer Login

Not a customer already?