PT-2009-6739 · Apache+15 · Apache Tomcat+24
Marsh Ray
+1
·
Published
1970-01-01
·
Updated
2026-05-27
·
CVE-2009-3555
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions prior to 0.9.8l
GnuTLS versions prior to 2.8.5
Apache HTTP Server versions prior to 2.2.14
Microsoft Internet Information Services (IIS) 7.0
OpenVPN versions prior to 2.3.1
Mozilla Network Security Services (NSS) versions prior to 3.12.4
Multiple Cisco products (affected versions not specified)
HP Integrated Lights-Out iLO2 and iLO3 (affected versions not specified)
FortiOS (affected versions not specified)
Apache Tomcat versions prior to 7.0.10, 6.0.32, and 5.5.33
Oracle (affected versions not specified)
openSUSE (multiple packages, affected versions not specified)
Red Hat Enterprise Linux (multiple packages, affected versions not specified)
CentOS (affected versions not specified)
Gentoo Linux (multiple packages, affected versions not specified)
SUSE Linux Enterprise (multiple packages, affected versions not specified)
Description
The vulnerability exists in the TLS/SSL protocol and can be exploited by an unauthenticated, remote attacker to conduct a man-in-the-middle attack. This can be done by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, allowing the attacker to insert data into HTTPS sessions. The attacker can also intercept traffic from a client to a TLS server and appear to authenticate the client to what the client thinks is the desired TLS server. However, the attacker would not be able to view the contents of the session and would only be able to inject data or requests into it.
Recommendations
For OpenSSL versions prior to 0.9.8l, update to version 0.9.8l or later.
For GnuTLS versions prior to 2.8.5, update to version 2.8.5 or later.
For Apache HTTP Server versions prior to 2.2.14, update to version 2.2.14 or later.
For Microsoft Internet Information Services (IIS) 7.0, apply the security update provided by Microsoft.
For OpenVPN versions prior to 2.3.1, update to version 2.3.1 or later.
For Mozilla Network Security Services (NSS) versions prior to 3.12.4, update to version 3.12.4 or later.
For HP Integrated Lights-Out iLO2 and iLO3, apply the security update provided by HP.
For FortiOS, enable secure renegotiation on the SSL Deep-Inspection.
For Apache Tomcat versions prior to 7.0.10, 6.0.32, and 5.5.33, update to version 7.0.10, 6.0.32, or 5.5.33 or later.
For Oracle, apply the security update provided by Oracle.
For openSUSE, Red Hat Enterprise Linux, CentOS, Gentoo Linux, and SUSE Linux Enterprise, update the affected packages to the latest versions.
As a temporary workaround, consider disabling the renegotiation feature in the TLS/SSL protocol until a patch is available. Restrict access to the vulnerable servers and services to minimize the risk of exploitation. Avoid using the vulnerable TLS/SSL protocol versions until the issue is resolved.
Exploit
Fix
DoS
Improper Certificate Validation
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Apache Http Server
Apache Tomcat
Centos
Cisco
Cisco Asa
Cisco Wls
Fortios
Gentoo Linux
Gnutls
Hp Integrated Lights-Out
Hpe Ilo
Hp-Ux
Internet Information Services
Network Security Services
Nginx
Openssl
Openvpn
Oracle
Oracle Database
Oracle Weblogic Server
Red Hat
Suse Linux Enterprise
Suse
Windows
Opensuse