CVE-2010-4180

Published: Dec 6, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

Affected (22)

Products: Openssl: Openssl · Fedoraproject: Fedora · Debian: Debian Linux · +4 more

Show all products

Openssl: Openssl · Fedoraproject: Fedora · Debian: Debian Linux · Canonical: Ubuntu Linux · Opensuse: Opensuse · Suse: Linux Enterprise, Linux Enterprise Desktop, Linux Enterprise Server · F5: Nginx

1 product

1 product

1 product

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Server

1 product

Nginx

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Before 0.9.8q
Openssl Openssl	From 1.0.0 to 1.0.0c

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 13
Fedoraproject Fedora	Version 14

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 5.0

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.04

Configuration E

11 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.2
Opensuse Opensuse	Version 11.3
Opensuse Opensuse	Version 11.4
Suse Linux Enterprise	Version 11.0 sp1
Suse Linux Enterprise Desktop	Version 10 sp3
Suse Linux Enterprise Desktop	Version 10 sp4
Suse Linux Enterprise Desktop	Version 11 sp1
Suse Linux Enterprise Server	Version 10 sp3
Suse Linux Enterprise Server	Version 10 sp4
Suse Linux Enterprise Server	Version 9

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
F5 Nginx	Before 0.9.2

References (100)

http://cvs.openssl.org/chngview?cn=20131

Source: secalert@redhat.com

Broken LinkPatch

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777

Source: secalert@redhat.com

Broken Link

http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

Source: secalert@redhat.com

Broken LinkMailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=bugtraq&m=129916880600544&w=2

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://marc.info/?l=bugtraq&m=130497251507577&w=2

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://marc.info/?l=bugtraq&m=132077688910227&w=2

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://openssl.org/news/secadv_20101202.txt

Source: secalert@redhat.com

PatchThird Party Advisory

http://osvdb.org/69565

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/42469

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/42473

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/42493

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/42571

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/42620

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/42811

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/42877

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/43169

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/43170

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/43171

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/43172

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/43173

Source: secalert@redhat.com

Not Applicable

http://secunia.com/advisories/44269

Source: secalert@redhat.com

Not Applicable

http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668471

Source: secalert@redhat.com

Third Party Advisory

http://support.apple.com/kb/HT4723

Source: secalert@redhat.com

Third Party Advisory

http://ubuntu.com/usn/usn-1029-1

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2011/dsa-2141

Source: secalert@redhat.com

Third Party Advisory

http://www.kb.cert.org/vuls/id/737740

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://www.mandriva.com/security/advisories?name=MDVSA-2010:248

Source: secalert@redhat.com

Permissions Required

http://www.redhat.com/support/errata/RHSA-2010-0977.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0978.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0979.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2011-0896.html

Source: secalert@redhat.com

Vendor Advisory

http://www.securityfocus.com/archive/1/522176

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/45164

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1024822

Source: secalert@redhat.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2010/3120

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/3122

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/3134

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2010/3188

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2011/0032

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2011/0076

Source: secalert@redhat.com

Permissions Required

http://www.vupen.com/english/advisories/2011/0268

Source: secalert@redhat.com

Permissions Required

https://bugzilla.redhat.com/show_bug.cgi?id=659462

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://kb.bluecoat.com/index?page=content&id=SA53&actp=LIST

Source: secalert@redhat.com

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18910

Source: secalert@redhat.com

Third Party Advisory

http://cvs.openssl.org/chngview?cn=20131