PT-2014-5421 · Nginx+2 · Nginx+2

Antoine Delignat-Lavaud + 1 · Publicado 2014-09-17 · Atualizado 2024-06-15 · CVE-2014-3616

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions nginx versions 0.5.6 through 1.7.4

Description The issue allows remote attackers with certain privileges to conduct virtual host confusion attacks by reusing a cached SSL session for an unrelated context when the same shared ssl session cache or ssl session ticket key is used for multiple servers.

Recommendations For versions 0.5.6 through 1.7.4, consider using unique ssl session cache or ssl session ticket key for each server to prevent the reuse of cached SSL sessions across different contexts.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

ALT-PU-2014-2153

CVE-2014-3616

DLA-55-1

DSA-3029-1

MGASA-2014-0427

OPENSUSE-SU-2024:10044-1

USN-2351-1

Produtos afetados

Alt Linux

Nginx

Ubuntu

Referências · 33

• https://suse.com/security/cve/CVE-2014-3556 · Nota
• https://suse.com/security/cve/CVE-2012-2089 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3616 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-2070 · Nota
• https://cve.org/CVERecord?id=CVE-2014-3616 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=14104 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10044-1 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2014-2153 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-3616 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-0746 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3616 · Nota de Segurança
• https://suse.com/security/cve/CVE-2011-4315 · Nota
• https://advisories.mageia.org/MGASA-2014-0427.html · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2014-0427 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3616 · Nota