CVE-2015-4000: Low severity OpenSSL OpenSSL vulnerability

The TLS protocol 1.2 and earlier, when a DHEEXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHEEXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHEEXPORT and then rewriting a ServerHello with DHEEXPORT replaced by DHE, aka the "Logjam" issue.

— Launchpad

TLS connections using Diffie-Hellman key exchange protocol were found to be vulnerable to an attack, in which a man-in-the-middle attacker could downgrade vulnerable TLS connections to 512-bit export-grade cryptography. The attack affects any server that supports DHEEXPORT ciphers. This attack can be conduted by precomputation on the 512 bit primes given in two popular sets of weak Diffie-Hellman parameters, namely Apache 2.1.5 - 2.4.7 and OpenSSL.

The following attack scenarios are possible:

1. Offline Decryption of Weak DHE Connections: This attack requires that the server default to using a Diffie-Hellman key exchange with 512-bit parameters. In this attack, there is a passive network adversary able to eavesdrop, who can obtain a transcript of the communication between the client and server.

2. DHEEXPORT Downgrade and Offline Decryption of TLS False Start: This attack only requires that a server support 512-bit parameters, but has a greater requirement of the client and attacker. The server, in this case, only needs to support DHEEXPORT cipher suites or use 512-bit parameters in non-export DHE ciphers. The client must be using the TLS False Start extension.

3. DHEEXPORT Downgrade and Man-In-The-Middle Server Impersonation: This is similar to the second attack, but does not need TLS False Start extension to be enabled. We instead require the client be willing to wait a significant amount of time for the handshake to complete. This is because the attacker must compute the connection key during the handshake process, but computing the key takes several minutes.

External Reference:

https://weakdh.org/ https://access.redhat.com/articles/1456263