onyx --cves cve-2009-3555
CVE-2009-3555
- score
- <0.1
- cvss
- 9.8
- epss
- 87.3%
- published
- 2009-11-09
- kev added
- 2009-11-18
- first seen
Multiple products including IIS 7.0, Apache 2.2.14, OpenSSL before 0.9.8l, GnuTLS 2.8.5, NSS 3.12.4, and Cisco products contain a TLS/SSL renegotiation vulnerability caused by improper association of renegotiation handshakes with existing connections, letting man-in-the-middle attackers inject data into sessions, exploit requires attacker to perform man-in-the-middle attack.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
- Public PoC https://www.exploit-db.com/exploits/10579
Exploit availability
Weaknesses
References 74
- http://www.securitytracker.com/id?1023224
- https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E
- http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://www.securityfocus.com/archive/1/508130/100/0/threaded
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://www.securityfocus.com/archive/1/515055/100/0/threaded
- http://www.securitytracker.com/id?1023206
- http://www.securitytracker.com/id?1023275
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54158
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html
- http://www.securityfocus.com/archive/1/522176
- http://www.securitytracker.com/id?1023211
- http://www.securitytracker.com/id?1023212
- http://www.securitytracker.com/id?1023219
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
- http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
- http://www.securityfocus.com/bid/36935
- http://www.securitytracker.com/id?1023208
- http://www.securitytracker.com/id?1023214
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
- http://www.securityfocus.com/archive/1/508075/100/0/threaded
49 more
- http://www.securitytracker.com/id?1023204
- http://www.securitytracker.com/id?1023207
- http://www.securitytracker.com/id?1023209
- http://www.securitytracker.com/id?1023213
- http://www.securitytracker.com/id?1024789
- http://kbase.redhat.com/faq/docs/DOC-20491
- http://www.securityfocus.com/archive/1/516397/100/0/threaded
- http://www.securitytracker.com/id?1023427
- https://bugzilla.mozilla.org/show_bug.cgi?id=526689
- https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html
- http://www.securitytracker.com/id?1023274
- http://www.us-cert.gov/cas/techalerts/TA10-287A.html
- http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
- http://securitytracker.com/id?1023148
- http://www.securityfocus.com/archive/1/507952/100/0/threaded
- http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html
- http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html
- http://www.securitytracker.com/id?1023216
- http://www.securitytracker.com/id?1023217
- https://www.exploit-db.com/exploits/10579
- http://www.securitytracker.com/id?1023411
- https://bugzilla.redhat.com/show_bug.cgi?id=533125
- http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html
- http://www.kb.cert.org/vuls/id/120541
- http://www.securitytracker.com/id?1023163
- http://www.securitytracker.com/id?1023270
- https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=545755
- http://www.securitytracker.com/id?1023215
- http://www.securitytracker.com/id?1023243
- http://www.securitytracker.com/id?1023272
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049
- https://packetstormsecurity.com/files/82770/SUSE-Security-Announcement-SUSE-SA-2009-057.html
- http://clicky.me/tlsvuln
- http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
- http://www.securitytracker.com/id?1023210
- http://www.securitytracker.com/id?1023218
- http://www.securitytracker.com/id?1023205
- http://www.securitytracker.com/id?1023271
- http://www.securitytracker.com/id?1023428
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
- http://www.securitytracker.com/id?1023273
- http://www.securitytracker.com/id?1023426
- http://www.us-cert.gov/cas/techalerts/TA10-222A.html
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html