CVE-2008-7270: Medium severity openssl vulnerability

Q: What is the severity of CVE-2008-7270?

CVE-2008-7270 is considered a medium severity vulnerability as it allows remote attackers to force the use of a disabled cipher.

Q: How do I fix CVE-2008-7270?

To remediate CVE-2008-7270, upgrade OpenSSL to version 0.9.8j or later.

Q: Which versions of OpenSSL are affected by CVE-2008-7270?

CVE-2008-7270 affects OpenSSL versions prior to 0.9.8j, including all versions in the 0.9.5, 0.9.6, and 0.9.7 series.

Q: What does CVE-2008-7270 exploit?

CVE-2008-7270 exploits a flaw in session caching that allows attackers to manipulate cipher suite utilization.

Q: Is there a workaround for CVE-2008-7270?

A potential workaround for CVE-2008-7270 is to disable the SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG option if possible.

Published Dec 6, 2010

Updated

OpenSSL before 0.9.8j, when SSLOPNETSCAPEREUSECIPHERCHANGEBUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.

Affected Software

61 affected components

OpenSSL OpenSSL<=0.9.8i

OpenSSL OpenSSL=0.9.1c

OpenSSL OpenSSL=0.9.2b

OpenSSL OpenSSL=0.9.3

OpenSSL OpenSSL=0.9.3a

OpenSSL OpenSSL=0.9.4

OpenSSL OpenSSL=0.9.5

OpenSSL OpenSSL=0.9.5-beta1

OpenSSL OpenSSL=0.9.5-beta2

OpenSSL OpenSSL=0.9.5a

OpenSSL OpenSSL=0.9.5a-beta1

OpenSSL OpenSSL=0.9.5a-beta2

OpenSSL OpenSSL=0.9.6

OpenSSL OpenSSL=0.9.6-beta1

OpenSSL OpenSSL=0.9.6-beta2

OpenSSL OpenSSL=0.9.6-beta3

OpenSSL OpenSSL=0.9.6a

OpenSSL OpenSSL=0.9.6a-beta1

OpenSSL OpenSSL=0.9.6a-beta2

OpenSSL OpenSSL=0.9.6a-beta3

OpenSSL OpenSSL=0.9.6b

OpenSSL OpenSSL=0.9.6c

OpenSSL OpenSSL=0.9.6d

OpenSSL OpenSSL=0.9.6e

OpenSSL OpenSSL=0.9.6f

OpenSSL OpenSSL=0.9.6g

OpenSSL OpenSSL=0.9.6h

OpenSSL OpenSSL=0.9.6i

OpenSSL OpenSSL=0.9.6j

OpenSSL OpenSSL=0.9.6k

OpenSSL OpenSSL=0.9.6l

OpenSSL OpenSSL=0.9.6m

OpenSSL OpenSSL=0.9.7

OpenSSL OpenSSL=0.9.7-beta1

OpenSSL OpenSSL=0.9.7-beta2

OpenSSL OpenSSL=0.9.7-beta3

OpenSSL OpenSSL=0.9.7-beta4

OpenSSL OpenSSL=0.9.7-beta5

OpenSSL OpenSSL=0.9.7-beta6

OpenSSL OpenSSL=0.9.7a

OpenSSL OpenSSL=0.9.7b

OpenSSL OpenSSL=0.9.7c

OpenSSL OpenSSL=0.9.7d

OpenSSL OpenSSL=0.9.7e

OpenSSL OpenSSL=0.9.7f

OpenSSL OpenSSL=0.9.7g

OpenSSL OpenSSL=0.9.7h

OpenSSL OpenSSL=0.9.7i

OpenSSL OpenSSL=0.9.7j

OpenSSL OpenSSL=0.9.7k

OpenSSL OpenSSL=0.9.7l

OpenSSL OpenSSL=0.9.7m

OpenSSL OpenSSL=0.9.8

OpenSSL OpenSSL=0.9.8a

OpenSSL OpenSSL=0.9.8b

OpenSSL OpenSSL=0.9.8c

OpenSSL OpenSSL=0.9.8d

OpenSSL OpenSSL=0.9.8e

OpenSSL OpenSSL=0.9.8f

OpenSSL OpenSSL=0.9.8g

OpenSSL OpenSSL=0.9.8h

Event History

Dec 6, 2010

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-7270?

CVE-2008-7270 is considered a medium severity vulnerability as it allows remote attackers to force the use of a disabled cipher.

How do I fix CVE-2008-7270?

To remediate CVE-2008-7270, upgrade OpenSSL to version 0.9.8j or later.

Which versions of OpenSSL are affected by CVE-2008-7270?