Multiple Vendor SSL/TLS Renegotiation Denial Of Service Vulnerability
BID:48626
Info
Multiple Vendor SSL/TLS Renegotiation Denial Of Service Vulnerability
| Bugtraq ID: | 48626 |
| Class: | Design Error |
| CVE: |
CVE-2011-1473 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 15 2011 12:00AM |
| Updated: | Mar 19 2015 09:23AM |
| Credit: | Jorge A. Orchilles |
| Vulnerable: |
SuSE SUSE Linux Enterprise High Availability Extension 11 SP2 OpenSSL Project OpenSSL 1.0.2 OpenSSL Project OpenSSL 1.0 OpenSSL Project OpenSSL 0.9.8 k OpenSSL Project OpenSSL 0.9.8 j OpenSSL Project OpenSSL 0.9.8 i OpenSSL Project OpenSSL 0.9.8 h OpenSSL Project OpenSSL 0.9.8 e OpenSSL Project OpenSSL 0.9.8 d OpenSSL Project OpenSSL 0.9.8 c OpenSSL Project OpenSSL 0.9.8 b OpenSSL Project OpenSSL 0.9.8 a OpenSSL Project OpenSSL 0.9.8 OpenSSL Project OpenSSL 0.9.7 m OpenSSL Project OpenSSL 0.9.7 l OpenSSL Project OpenSSL 0.9.7 k OpenSSL Project OpenSSL 0.9.7 j OpenSSL Project OpenSSL 0.9.7 i OpenSSL Project OpenSSL 0.9.7 h OpenSSL Project OpenSSL 0.9.7 g OpenSSL Project OpenSSL 0.9.7 f OpenSSL Project OpenSSL 0.9.7 e OpenSSL Project OpenSSL 0.9.7 d OpenSSL Project OpenSSL 0.9.7 c OpenSSL Project OpenSSL 0.9.7 beta3 OpenSSL Project OpenSSL 0.9.7 beta2 OpenSSL Project OpenSSL 0.9.7 beta1 OpenSSL Project OpenSSL 0.9.7 b OpenSSL Project OpenSSL 0.9.7 a OpenSSL Project OpenSSL 0.9.7 OpenSSL Project OpenSSL 0.9.6 m OpenSSL Project OpenSSL 0.9.6 l OpenSSL Project OpenSSL 0.9.6 k OpenSSL Project OpenSSL 0.9.6 j OpenSSL Project OpenSSL 0.9.6 i OpenSSL Project OpenSSL 0.9.6 h OpenSSL Project OpenSSL 0.9.6 g OpenSSL Project OpenSSL 0.9.6 f OpenSSL Project OpenSSL 0.9.6 e OpenSSL Project OpenSSL 0.9.6 d OpenSSL Project OpenSSL 0.9.6 c OpenSSL Project OpenSSL 0.9.6 b-36.8 OpenSSL Project OpenSSL 0.9.6 b OpenSSL Project OpenSSL 0.9.6 a OpenSSL Project OpenSSL 0.9.6 OpenSSL Project OpenSSL 0.9.5 a OpenSSL Project OpenSSL 0.9.5 OpenSSL Project OpenSSL 0.9.4 OpenSSL Project OpenSSL 0.9.3 OpenSSL Project OpenSSL 0.9.2 b OpenSSL Project OpenSSL 0.9.1 c OpenSSL Project OpenSSL 1.0.0c OpenSSL Project OpenSSL 1.0.0b OpenSSL Project OpenSSL 1.0.0b OpenSSL Project OpenSSL 1.0.0a OpenSSL Project OpenSSL 1.0.0A OpenSSL Project OpenSSL 0.9.8Q OpenSSL Project OpenSSL 0.9.8p OpenSSL Project OpenSSL 0.9.8p OpenSSL Project OpenSSL 0.9.8o OpenSSL Project OpenSSL 0.9.8O OpenSSL Project OpenSSL 0.9.8n OpenSSL Project OpenSSL 0.9.8N OpenSSL Project OpenSSL 0.9.8M OpenSSL Project OpenSSL 0.9.8m OpenSSL Project OpenSSL 0.9.8g OpenSSL Project OpenSSL 0.9.8f OpenSSL Project OpenSSL 0.9.8 f HP Onboard Administrator 3.50 Blue Coat Systems Proxysg 6.2 Blue Coat Systems Proxysg 6.1 Blue Coat Systems Proxysg 5.5 Blue Coat Systems Proxysg 5.3 |
| Not Vulnerable: |
OpenSSL Project OpenSSL 0.9.8l |
Discussion
Multiple Vendor SSL/TLS Renegotiation Denial Of Service Vulnerability
Multiple vendors' SSL/TLS protocol implementations are prone to a denial-of-service vulnerability.
An attacker can exploit this issue to consume excessive resources, denying service to legitimate users.
Multiple vendors' SSL/TLS protocol implementations are prone to a denial-of-service vulnerability.
An attacker can exploit this issue to consume excessive resources, denying service to legitimate users.
Exploit / POC
Multiple Vendor SSL/TLS Renegotiation Denial Of Service Vulnerability
The following proof-of-concept tool is available:
The following proof-of-concept tool is available:
Solution / Fix
Multiple Vendor SSL/TLS Renegotiation Denial Of Service Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple Vendor SSL/TLS Renegotiation Denial Of Service Vulnerability
References:
References:
- [TLS] SSL Renegotiation DOS ("Jorge A. Orchilles"
) - Bug 707065 - (CVE-2011-1473) CVE-2011-1473 SSL/TLS: DoS via repeated SSL session (Vincent Danen)
- SSL / TLS Renegotiation DoS (Tenable Security)
- SSL renegotiation DoS CVE-2011-1473 (Tomas Hoger)