JVN#61247051: OpenSSL improper handling of Change Cipher Spec message

OpenSSL contains a flaw in the implementation of the Change Cipher Spec protocol that allows a MITM (man-in-the-middle) attacker to force a server and a client to use easily guessable cryptgraphic key material during the initial SSL/TLS handshake (CWE-325).

Impact

SSL/TLS communication between the server and the client can be decrypted or altered by the MITM attacker.

Solution

Update the software
Update to the latest version according to the information provided by the developer.

Products Affected

It is confirmed that the SSL/TLS communication between a server and a client using the following vulnerable OpenSSL versions is affected.

Server:

• OpenSSL 1.0.1g and earlier
  Client:

• OpenSSL 1.0.1g and earlier

• OpenSSL 1.0.0l and earlier

• OpenSSL 0.9.8y and earlier