OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

Bugtraq ID:	45254
Class:	Design Error
CVE:	CVE-2008-7270
Remote:	Yes
Local:	No
Published:	Sep 22 2008 12:00AM
Updated:	Mar 19 2015 08:20AM
Credit:	bodo
Vulnerable:	VMWare ESX 4.1 VMWare ESX 4.0 Sun Solaris 10_x86 Sun Solaris 10_sparc RedHat JBoss Enterprise Web Server EL4 0 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop version 4 Red Hat JBoss Enterprise Web Server for Windows 1.0 Red Hat JBoss Enterprise Web Server for Solaris 1.0 Red Hat JBoss Enterprise Web Server for RHEL 6 1.0 Red Hat JBoss Enterprise Web Server for RHEL 5 Server 1.0 Red Hat JBoss Enterprise Web Server for RHEL 4 ES 1.0 Red Hat JBoss Enterprise Web Server for RHEL 4 AS 1.0 Red Hat JBoss Enterprise Web Server 5.0 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux 5 Server OpenSSL Project OpenSSL 0.9.8 i OpenSSL Project OpenSSL 0.9.8 h OpenSSL Project OpenSSL 0.9.8 e OpenSSL Project OpenSSL 0.9.8 d OpenSSL Project OpenSSL 0.9.8 c OpenSSL Project OpenSSL 0.9.8 b OpenSSL Project OpenSSL 0.9.8 a OpenSSL Project OpenSSL 0.9.8 + Gentoo Linux OpenSSL Project OpenSSL 0.9.7 m OpenSSL Project OpenSSL 0.9.7 l OpenSSL Project OpenSSL 0.9.7 k OpenSSL Project OpenSSL 0.9.7 j OpenSSL Project OpenSSL 0.9.7 i OpenSSL Project OpenSSL 0.9.7 h OpenSSL Project OpenSSL 0.9.7 g OpenSSL Project OpenSSL 0.9.7 f OpenSSL Project OpenSSL 0.9.7 e OpenSSL Project OpenSSL 0.9.7 d OpenSSL Project OpenSSL 0.9.7 c OpenSSL Project OpenSSL 0.9.7 beta3 OpenSSL Project OpenSSL 0.9.7 beta2 OpenSSL Project OpenSSL 0.9.7 beta1 OpenSSL Project OpenSSL 0.9.7 b OpenSSL Project OpenSSL 0.9.7 a + Conectiva Linux 9.0 + OpenPKG OpenPKG Current OpenSSL Project OpenSSL 0.9.7 OpenSSL Project OpenSSL 0.9.6 m OpenSSL Project OpenSSL 0.9.6 l OpenSSL Project OpenSSL 0.9.6 k OpenSSL Project OpenSSL 0.9.6 j OpenSSL Project OpenSSL 0.9.6 i OpenSSL Project OpenSSL 0.9.6 h OpenSSL Project OpenSSL 0.9.6 g OpenSSL Project OpenSSL 0.9.6 f OpenSSL Project OpenSSL 0.9.6 e OpenSSL Project OpenSSL 0.9.6 d + Slackware Linux 8.1 OpenSSL Project OpenSSL 0.9.6 c OpenSSL Project OpenSSL 0.9.6 b-36.8 OpenSSL Project OpenSSL 0.9.6 b OpenSSL Project OpenSSL 0.9.6 a + Conectiva Linux 7.0 + NetBSD NetBSD 1.5.3 + NetBSD NetBSD 1.5.2 + NetBSD NetBSD 1.5.1 + NetBSD NetBSD 1.5 + S.u.S.E. Linux 7.2 i386 + S.u.S.E. Linux 7.1 sparc + S.u.S.E. Linux 7.1 ppc + S.u.S.E. Linux 7.1 alpha + S.u.S.E. Linux 7.1 OpenSSL Project OpenSSL 0.9.6 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Conectiva Linux 6.0 + EnGarde Secure Linux 1.0.1 + HP Secure OS software for Linux 1.0 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + NetBSD NetBSD 1.6 beta + NetBSD NetBSD 1.6 + NetBSD NetBSD 1.5.3 + NetBSD NetBSD 1.5.2 + NetBSD NetBSD 1.5.1 + NetBSD NetBSD 1.5 + OpenBSD OpenBSD 2.9 + OpenPKG OpenPKG 1.0 + RedHat Linux 7.3 i386 + RedHat Linux 7.3 + RedHat Linux 7.2 i386 + RedHat Linux 7.2 alpha + RedHat Linux 7.1 i386 + RedHat Linux 7.1 alpha + RedHat Linux 7.0 sparc + RedHat Linux 7.0 i386 + RedHat Linux 7.0 alpha + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 OpenSSL Project OpenSSL 0.9.5 a + Debian Linux 3.0 + HP Secure OS software for Linux 1.0 + Immunix Immunix OS 7.0 + Immunix Immunix OS 6.2 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + OpenBSD OpenBSD 2.8 + OpenBSD OpenBSD 2.7 + Red Hat Linux 6.2 + RedHat Linux 7.3 i386 + RedHat Linux 7.2 ia64 + RedHat Linux 7.2 i686 + RedHat Linux 7.2 i386 + RedHat Linux 7.2 alpha + RedHat Linux 7.2 + RedHat Linux 7.1 ia64 + RedHat Linux 7.1 i386 + RedHat Linux 7.1 alpha + RedHat Linux 7.1 + RedHat Linux 7.0 i386 + RedHat Linux 7.0 alpha + RedHat Linux 7.0 + RedHat Linux 6.2 sparc + RedHat Linux 6.2 i386 + RedHat Linux 6.2 alpha + S.u.S.E. Linux 7.0 sparc + S.u.S.E. Linux 7.0 ppc + S.u.S.E. Linux 7.0 i386 + S.u.S.E. Linux 7.0 alpha OpenSSL Project OpenSSL 0.9.5 OpenSSL Project OpenSSL 0.9.4 + Debian Linux 3.0 + OpenBSD OpenBSD 2.6 OpenSSL Project OpenSSL 0.9.3 OpenSSL Project OpenSSL 0.9.2 b OpenSSL Project OpenSSL 0.9.1 c OpenSSL Project OpenSSL 0.9.8g OpenSSL Project OpenSSL 0.9.8f OpenSSL Project OpenSSL 0.9.8 f HP ProCurve Switch 5348XL J4849A HP ProCurve Switch 5308XL J4819A HP ProCurve Switch 5304XL J4850A HP Onboard Administrator 3.32 HP Onboard Administrator 3.31 HP Onboard Administrator 3.21 HP Integrated Lights Out 3 2.05 HP Integrated Lights Out 2 1.16 Balabit syslog-ng Premium Edition 4.0.1 Balabit syslog-ng Premium Edition 3.2 Balabit syslog-ng Premium Edition 3.0.7 Balabit syslog-ng Premium Edition 3.0.6 Balabit syslog-ng Premium Edition 3.0.5 Balabit syslog-ng Premium Edition 3.2.1A Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Voice Portal 4.1 SP2 Avaya Voice Portal 4.1 SP1 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya Proactive Contact 4.1.2 Avaya Proactive Contact 4.1.1 Avaya Proactive Contact 4.2.2 Avaya Proactive Contact 4.2.1 Avaya Proactive Contact 4.2 Avaya Proactive Contact 4.1 Avaya Proactive Contact 4.0.1 Avaya Proactive Contact 4.0 Avaya Messaging Storage Server 5.2.8 Avaya Messaging Storage Server 5.2.2 Avaya Messaging Storage Server 5.2 SP3 Avaya Messaging Storage Server 5.2 SP2 Avaya Messaging Storage Server 5.2 SP1 Avaya Messaging Storage Server 5.2 Avaya Messaging Storage Server 5.1 SP2 Avaya Messaging Storage Server 5.1 SP1 Avaya Messaging Storage Server 5.1 Avaya Messaging Storage Server 5.0 Avaya Messaging Storage Server 4.0 Avaya Message Networking 5.2.1 Avaya Message Networking 5.2.3 Avaya Message Networking 5.2.2 Avaya Message Networking 5.2 SP1 Avaya Message Networking 5.2 Avaya Message Networking 3.1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 Avaya IQ 5.1 Avaya IQ 5 Avaya IP Office Application Server 6.1 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.1 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura SIP Enablement Services 5.2.1 Avaya Aura SIP Enablement Services 5.2 Avaya Aura SIP Enablement Services 5.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura SIP Enablement Services 4.0 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Conferencing 6.0 Standard Avaya Aura Communication Manager 6.0.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager 6.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager 5.2 Avaya Aura Communication Manager 5.1 Avaya Aura Communication Manager 4.0 Avaya Aura Communication Manager 4.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 4.2.3 Avaya Aura Application Enablement Services 4.2.2 Avaya Aura Application Enablement Services 4.2.1 Avaya Aura Application Enablement Services 4.0.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 Avaya Aura Application Enablement Services 4.2 Avaya Aura Application Enablement Services 4.1 Avaya Aura Application Enablement Services 4.0
Not Vulnerable:	Red Hat JBoss Enterprise Web Server for Windows 1.0.2 Red Hat JBoss Enterprise Web Server for Solaris 1.0.2 Red Hat JBoss Enterprise Web Server for RHEL 6 1.0.2 Red Hat JBoss Enterprise Web Server for RHEL 5 Server 1.0.2 Red Hat JBoss Enterprise Web Server for RHEL 4 ES 1.0.2 Red Hat JBoss Enterprise Web Server for RHEL 4 AS 1.0.2 OpenSSL Project OpenSSL 0.9.8 j Balabit syslog-ng Premium Edition 4.0.1a Balabit syslog-ng Premium Edition 3.2.1B Balabit syslog-ng Premium Edition 3.0.7a

OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

OpenSSL Ciphersuite Modification Allows Disabled Cipher Security Bypass Vulnerability

References:

• [syslog-ng-announce] syslog-ng Premium Edition 3.0.7a has been released (BalaBit)
  
• [syslog-ng-announce] syslog-ng Premium Edition 3.2.1b has been released (BalaBit)
  
• [syslog-ng-announce] syslog-ng Premium Edition 4.0.1a has been released (Balabit)
  
• CVE-2008-7270 vulnerability in OpenSSL (Oracle)
  
• HPSBMU02759 SSRT100817 rev.1 - HP Onboard Administrator (OA), Remote Unauthorize (HP)
  
• Multiple OpenSSL vulnerabilities in Sun SPARC Enterprise M-series XCP Firmware (Oracle)
  
• openssl - Check-in [17489] Make sure that SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BU (bodo)
  
• OpenSSL Homepage (OpenSSL)
  
• VMSA-2011-0013 (VMWare)
  
• ASA-2011-003 openssl security update (RHSA-2010-0977) (Avaya)
  
• ASA-2011-003 openssl security update (RHSA-2010-0977) (avaya)
  
• ASA-2011-005 openssl security update (RHSA-2010-0978) (Avaya)
  
• HPSBHF02706 SSRT100613 rev.1 - HP Integrated Lights-Out iLO2 and iLO3 running SS (HP)
  
• HPSBPV02891 rev.1 - HP ProCurve Switches, Remote Unauthorized Information Disclo (HP)
  
• openssl security update (RHSA-2010-0977) (Avaya)