CVE-2005-2969

Published Oct 18, 2005

Last updated 7 years ago

Overview

Description: The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.
Source: secalert@redhat.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Vendor comments

Red HatRed Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "45A518E8-21BE-4C5C-B425-410AB1208E9C"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "78E79A05-64F3-4397-952C-A5BB950C967D"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7F7C9E77-1EB2-4720-A8FD-23DC1C877D5A"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "549BB01D-F322-4FE3-BDA2-4FEA8ED8568A"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4DE6CBD6-D6DD-4BC5-93F6-FDEA70163336"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "98693865-2E79-4BD6-9F89-1994BC9A3E73"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D6476506-EC37-4726-82DC-D0E8254A8CDD"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5D6ECEF7-CB16-4604-894B-6EB19F1CEF55"
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8A4E446D-B9D3-45F2-9722-B41FA14A6C31"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Vendor comments

Configurations

References