Lucene search

[email protected]NVD:CVE-2005-2969

HistoryOct 18, 2005 - 9:02 p.m.

CVE-2005-2969

2005-10-1821:02:00

[email protected]

web.nvd.nist.gov

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.011

Percentile

84.4%

JSON

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSL_OP_MSIE_SSLV2_RSA_PADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to use a weaker protocol than needed via a man-in-the-middle attack.

Affected configurations

Nvd

Node

opensslopensslMatch0.9.7

opensslopensslMatch0.9.7a

opensslopensslMatch0.9.7b

opensslopensslMatch0.9.7c

opensslopensslMatch0.9.7d

opensslopensslMatch0.9.7e

opensslopensslMatch0.9.7f

opensslopensslMatch0.9.7g

opensslopensslMatch0.9.8

VendorProductVersionCPE
opensslopenssl0.9.7cpe:2.3:a:openssl:openssl:0.9.7:*:*:*:*:*:*:*
opensslopenssl0.9.7acpe:2.3:a:openssl:openssl:0.9.7a:*:*:*:*:*:*:*
opensslopenssl0.9.7bcpe:2.3:a:openssl:openssl:0.9.7b:*:*:*:*:*:*:*
opensslopenssl0.9.7ccpe:2.3:a:openssl:openssl:0.9.7c:*:*:*:*:*:*:*
opensslopenssl0.9.7dcpe:2.3:a:openssl:openssl:0.9.7d:*:*:*:*:*:*:*
opensslopenssl0.9.7ecpe:2.3:a:openssl:openssl:0.9.7e:*:*:*:*:*:*:*
opensslopenssl0.9.7fcpe:2.3:a:openssl:openssl:0.9.7f:*:*:*:*:*:*:*
opensslopenssl0.9.7gcpe:2.3:a:openssl:openssl:0.9.7g:*:*:*:*:*:*:*
opensslopenssl0.9.8cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openssl	openssl	0.9.7	cpe:2.3:a:openssl:openssl:0.9.7:::::::*
openssl	openssl	0.9.7a	cpe:2.3:a:openssl:openssl:0.9.7a:::::::*
openssl	openssl	0.9.7b	cpe:2.3:a:openssl:openssl:0.9.7b:::::::*
openssl	openssl	0.9.7c	cpe:2.3:a:openssl:openssl:0.9.7c:::::::*
openssl	openssl	0.9.7d	cpe:2.3:a:openssl:openssl:0.9.7d:::::::*
openssl	openssl	0.9.7e	cpe:2.3:a:openssl:openssl:0.9.7e:::::::*
openssl	openssl	0.9.7f	cpe:2.3:a:openssl:openssl:0.9.7f:::::::*
openssl	openssl	0.9.7g	cpe:2.3:a:openssl:openssl:0.9.7g:::::::*
openssl	openssl	0.9.8	cpe:2.3:a:openssl:openssl:0.9.8:::::::*

References

ftp://ftp.software.ibm.com/pc/pccbbs/pc_servers/dir5.10.3_docs_relnotes.pdf

docs.info.apple.com/article.html?artnum=302847

itrc.hp.com/service/cki/docDisplay.do?docId=c00805100

itrc.hp.com/service/cki/docDisplay.do?docId=c00849540

lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html

secunia.com/advisories/17146

secunia.com/advisories/17151

secunia.com/advisories/17153

secunia.com/advisories/17169

secunia.com/advisories/17178

secunia.com/advisories/17180

secunia.com/advisories/17189

secunia.com/advisories/17191

secunia.com/advisories/17210

secunia.com/advisories/17259

secunia.com/advisories/17288

secunia.com/advisories/17335

secunia.com/advisories/17344

secunia.com/advisories/17389

secunia.com/advisories/17409

secunia.com/advisories/17432

secunia.com/advisories/17466

secunia.com/advisories/17589

secunia.com/advisories/17617

secunia.com/advisories/17632

secunia.com/advisories/17813

secunia.com/advisories/17888

secunia.com/advisories/18045

secunia.com/advisories/18123

secunia.com/advisories/18165

secunia.com/advisories/18663

secunia.com/advisories/19185

secunia.com/advisories/21827

secunia.com/advisories/23280

secunia.com/advisories/23340

secunia.com/advisories/23843

secunia.com/advisories/23915

secunia.com/advisories/25973

secunia.com/advisories/26893

secunia.com/advisories/31492

securitytracker.com/id?1015032

sunsolve.sun.com/search/document.do?assetkey=1-26-101974-1

support.avaya.com/elmodocs2/security/ASA-2006-031.htm

support.avaya.com/elmodocs2/security/ASA-2006-260.htm

www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754

www.cisco.com/warp/public/707/cisco-response-20051202-openssl.shtml

www.debian.org/security/2005/dsa-875

www.debian.org/security/2005/dsa-881

www.debian.org/security/2005/dsa-882

www.hitachi-support.com/security_e/vuls_e/HS06-022_e/01-e.html

www.hitachi-support.com/security_e/vuls_e/HS07-016_e/index-e.html

www.juniper.net/support/security/alerts/PSN-2005-12-025.txt

www.mandriva.com/security/advisories?name=MDKSA-2005:179

www.novell.com/linux/security/advisories/2005_61_openssl.html

www.openssl.org/news/secadv_20051011.txt

www.redhat.com/support/errata/RHSA-2005-762.html

www.redhat.com/support/errata/RHSA-2005-800.html

www.redhat.com/support/errata/RHSA-2008-0629.html

www.securityfocus.com/bid/15071

www.securityfocus.com/bid/15647

www.securityfocus.com/bid/24799

www.vupen.com/english/advisories/2005/2036

www.vupen.com/english/advisories/2005/2659

www.vupen.com/english/advisories/2005/2710

www.vupen.com/english/advisories/2005/2908

www.vupen.com/english/advisories/2005/3002

www.vupen.com/english/advisories/2005/3056

www.vupen.com/english/advisories/2006/3531

www.vupen.com/english/advisories/2007/0326

www.vupen.com/english/advisories/2007/0343

www.vupen.com/english/advisories/2007/2457

exchange.xforce.ibmcloud.com/vulnerabilities/35287

issues.rpath.com/browse/RPL-1633

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11454

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.011

Percentile

84.4%

JSON

Related for NVD:CVE-2005-2969

freebsd1 ubuntu1 debian8 openvas26 cve1 f52 nessus25 ubuntucve1 debiancve1 jvn1 altlinux3 gentoo1 osv1 cvelist1 suse1 slackware1 securityvulns1 freebsd_advisory1 openssl1 centos2 redhat4 cisco1 oraclelinux3