National Vulnerability Database (CVE-2005-2969)

National Cyber-Alert System Vulnerability Summary: CVE-2005-2969
Orirignal release date: 2005-10-18 Source: US-CERT/NIST ### Overview The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack. ### Impact CVSS Severity: 3.3 (Low) Range: remote Authentication: config Impact Type: int ### Reference to Advisories, Solutions, and Tools External Source: SUSE Name: SUSE-SA:2005:061 Hyperlink: http://www.novell.com/linux/security/advisories/2005_61_openssl.html External Source: NSO Name: http://www.openssl.org/news/secadv_20051011.txt adv=1 patch=1 Hyperlink: http://www.openssl.org/news/secadv_20051011.txt adv=1 patch=1 External Source: REDHAT Name: RHSA-2005:800 Hyperlink: http://www.redhat.com/support/errata/RHSA-2005-800.html External Source: DEBIAN Name: DSA-875 Hyperlink: http://www.debian.org/security/2005/dsa-875 External Source: MANDRIVA Name: MDKSA-2005:179 Hyperlink: http://www.mandriva.com/security/advisories?name=MDKSA-2005:179 External Source: TRUSTIX Name: TSLSA-2005-0059 Hyperlink: http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html External Source: DEBIAN Name: DSA-881 Hyperlink: http://www.debian.org/security/2005/dsa-881 External Source: DEBIAN Name: DSA-882 Hyperlink: http://www.debian.org/security/2005/dsa-882 External Source: APPLE Name: APPLE-SA-2005-11-29 Hyperlink: http://docs.info.apple.com/article.html?artnum=302847 External Source: BID Name: 15647 Hyperlink: http://www.securityfocus.com/bid/15647 External Source: SECUNIA Name: 17813 Hyperlink: http://secunia.com/advisories/17813 External Source: CISCO Name: 20051202 Cisco Security Notice: Response to OpenSSL - Potential SSL 2.0 Rollback Hyperlink: http://www.cisco.com/warp/public/707/cisco-response-20051202-openssl.shtml External Source: FRSIRT Name: ADV-2005-2710 Hyperlink: http://www.frsirt.com/english/advisories/2005/2710 External Source: SECUNIA Name: 17888 Hyperlink: http://secunia.com/advisories/17888 External Source: FRSIRT Name: ADV-2005-2908 Hyperlink: http://www.frsirt.com/english/advisories/2005/2908 External Source: SECUNIA Name: 18045 Hyperlink: http://secunia.com/advisories/18045 External Source: NSO Name: http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754 Hyperlink: http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754 External Source: BID Name: 15071 Hyperlink: http://www.securityfocus.com/bid/15071 External Source: FRSIRT Name: ADV-2005-2036 Hyperlink: http://www.frsirt.com/english/advisories/2005/2036 External Source: FRSIRT Name: ADV-2005-3002 Hyperlink: http://www.frsirt.com/english/advisories/2005/3002 External Source: SECUNIA Name: 17151 Hyperlink: http://secunia.com/advisories/17151 External Source: SECUNIA Name: 18165 Hyperlink: http://secunia.com/advisories/18165 External Source: NSO Name: http://www.juniper.net/support/security/alerts/PSN-2005-12-025.txt Hyperlink: http://www.juniper.net/support/security/alerts/PSN-2005-12-025.txt External Source: FRSIRT Name: ADV-2005-3056 Hyperlink: http://www.frsirt.com/english/advisories/2005/3056 External Source: SECUNIA Name: 18123 Hyperlink: http://secunia.com/advisories/18123 External Source: SECTRACK Name: 1015032 Hyperlink: http://securitytracker.com/id?1015032 External Source: SECUNIA Name: 17146 Hyperlink: http://secunia.com/advisories/17146 External Source: SECUNIA Name: 17153 Hyperlink: http://secunia.com/advisories/17153 External Source: SECUNIA Name: 17169 Hyperlink: http://secunia.com/advisories/17169 External Source: SECUNIA Name: 17178 Hyperlink: http://secunia.com/advisories/17178 External Source: SECUNIA Name: 17180 Hyperlink: http://secunia.com/advisories/17180 External Source: SECUNIA Name: 17189 Hyperlink: http://secunia.com/advisories/17189 External Source: SECUNIA Name: 17191 Hyperlink: http://secunia.com/advisories/17191 External Source: SECUNIA Name: 17210 Hyperlink: http://secunia.com/advisories/17210 External Source: SECUNIA Name: 17259 Hyperlink: http://secunia.com/advisories/17259 External Source: SECUNIA Name: 17288 Hyperlink: http://secunia.com/advisories/17288 External Source: SECUNIA Name: 17335 Hyperlink: http://secunia.com/advisories/17335 External Source: SECUNIA Name: 17344 Hyperlink: http://secunia.com/advisories/17344 External Source: SECUNIA Name: 17389 Hyperlink: http://secunia.com/advisories/17389 External Source: SECUNIA Name: 17409 Hyperlink: http://secunia.com/advisories/17409 External Source: SECUNIA Name: 17432 Hyperlink: http://secunia.com/advisories/17432 External Source: SECUNIA Name: 17466 Hyperlink: http://secunia.com/advisories/17466 External Source: SECUNIA Name: 17589 Hyperlink: http://secunia.com/advisories/17589 External Source: SECUNIA Name: 17617 Hyperlink: http://secunia.com/advisories/17617 External Source: SECUNIA Name: 17632 Hyperlink: http://secunia.com/advisories/17632 External Source: FRSIRT Name: ADV-2005-2659 Hyperlink: http://www.frsirt.com/english/advisories/2005/2659 External Source: REDHAT Name: RHSA-2005:762 Hyperlink: http://www.redhat.com/support/errata/RHSA-2005-762.html ### Vulnerable Software and Vendor OpenSSL (OpenSSL) Technical Details CVE Standard Vulnerability Entry: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2969