JP1/HiCommand Series Products OpenSSL Insecure Protocol Negotiation Weakness
BID:24799
Info
JP1/HiCommand Series Products OpenSSL Insecure Protocol Negotiation Weakness
| Bugtraq ID: | 24799 |
| Class: | Design Error |
| CVE: |
CVE-2005-2969 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 06 2007 12:00AM |
| Updated: | Aug 25 2008 11:15PM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Redhat Red Hat Network Satellite Server 4.2 Redhat Red Hat Network Satellite (for RHEL 4) 5.1 Hitachi JP1/HiCommand Tiered Storage Manager 05-50 Hitachi JP1/HiCommand Tiered Storage Manager 05-30 Hitachi JP1/HiCommand Tiered Storage Manager 04-00 Hitachi JP1/HiCommand Replication Monitor 04-00 Hitachi JP1/HiCommand GlobalLink Availability Manager 05-00 Hitachi JP1/HiCommand Device Manager (Linux) 05.10 Hitachi JP1/Hi Command Tiered Storage Manager (Solaris) 4.3 Hitachi JP1/Hi Command Device Manager 05.50 Hitachi JP1/Hi Command Device Manager 02.30 |
| Not Vulnerable: | |
Discussion
JP1/HiCommand Series Products OpenSSL Insecure Protocol Negotiation Weakness
JP1/HiCommand Series Products are prone to a remote protocol-negotiation weakness due to a design error.
Successful exploits may allow an attacker connecting to the affected server to replace the SSL 3 or TLS 1 protocol with the SSL 2 protocol. This may allow the attacker to exploit insecurities in SSL version 2 to gain access to or tamper with the clear-text communications between the targeted client and server.
NOTE: This issue may be related to BID 15071 (OpenSSL Insecure Protocol Negotiation Weakness).
JP1/HiCommand Series Products are prone to a remote protocol-negotiation weakness due to a design error.
Successful exploits may allow an attacker connecting to the affected server to replace the SSL 3 or TLS 1 protocol with the SSL 2 protocol. This may allow the attacker to exploit insecurities in SSL version 2 to gain access to or tamper with the clear-text communications between the targeted client and server.
NOTE: This issue may be related to BID 15071 (OpenSSL Insecure Protocol Negotiation Weakness).
Exploit / POC
JP1/HiCommand Series Products OpenSSL Insecure Protocol Negotiation Weakness
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
JP1/HiCommand Series Products OpenSSL Insecure Protocol Negotiation Weakness
Solution:
The vendor has released fixes to address this issue. Please see the references for more information.
Solution:
The vendor has released fixes to address this issue. Please see the references for more information.
References
JP1/HiCommand Series Products OpenSSL Insecure Protocol Negotiation Weakness
References:
References:
- Hitachi Device Manager Homepage ( Hitachi)
- HS07-016: Protocol-version Rollback Vulnerability in OpenSSL of JP1/HiCommand Se (Hitachi)
- RHSA-2008:0525-5 Red Hat Network Satellite Server Solaris client security update (Red Hat)
- RHSA-2008:0629-3 Moderate: Red Hat Network Satellite Server Solaris client secur (Red Hat)