Home > Vulnerability Database > CVE-2010-4180

Mend Vulnerability Database

New vulnerability? Tell us about it!

CVE-2010-4180

Good to know:

Date: December 6, 2010

OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.

Language: C

Severity Score

3.7

Related Resources (53)

Url: http://www.redhat.com/support/errata/RHSA-2010-0978.html

Url: http://www.vupen.com/english/advisories/2010/3122

Url: https://bugzilla.redhat.com/show_bug.cgi?id=659462

Url: http://www.vupen.com/english/advisories/2010/3120

Url: http://secunia.com/advisories/43170

Url: http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html

Url: http://secunia.com/advisories/42473

Url: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html

Url: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html

Url: http://ubuntu.com/usn/usn-1029-1

Url: http://www.redhat.com/support/errata/RHSA-2010-0979.html

Url: http://secunia.com/advisories/42877

Url: http://secunia.com/advisories/43169

Url: https://access.redhat.com/security/cve/CVE-2010-4180

Url: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html

Url: http://www.securityfocus.com/archive/1/522176

Url: https://nvd.nist.gov/vuln/detail/CVE-2010-4180

Url: http://secunia.com/advisories/42469

Url: http://www.redhat.com/support/errata/RHSA-2010-0977.html

Url: http://marc.info/?l=bugtraq&m=130497251507577&w=2

Url: http://www.vupen.com/english/advisories/2011/0268

Url: http://www.securityfocus.com/bid/45164

Url: http://secunia.com/advisories/42620

Url: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777

Url: http://www.securitytracker.com/id?1024822

Url: http://www.vupen.com/english/advisories/2010/3188

Url: http://osvdb.org/69565

Url: http://secunia.com/advisories/42571

Url: http://support.apple.com/kb/HT4723

Url: http://secunia.com/advisories/42493

Url: http://openssl.org/news/secadv_20101202.txt

Url: http://cvs.openssl.org/chngview?cn=20131

Url: http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html

Url: http://www.vupen.com/english/advisories/2011/0032

Url: http://www.vupen.com/english/advisories/2011/0076

Url: http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.668471

Url: http://secunia.com/advisories/42811

Url: http://www.redhat.com/support/errata/RHSA-2011-0896.html

Url: https://kb.bluecoat.com/index?page=content&id=SA53&actp=LIST

Url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18910

Url: http://marc.info/?l=bugtraq&m=129916880600544&w=2

Url: http://www.vupen.com/english/advisories/2010/3134

Url: http://www.mandriva.com/security/advisories?name=MDVSA-2010:248

Url: http://www.kb.cert.org/vuls/id/737740

Url: http://marc.info/?l=bugtraq&m=132077688910227&w=2

Url: http://secunia.com/advisories/43173

Url: http://secunia.com/advisories/43171

Url: http://secunia.com/advisories/43172

Url: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html

Url: http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

Url: http://www.debian.org/security/2011/dsa-2141

Url: http://secunia.com/advisories/44269

Url: https://www.mend.io/vulnerability-database/CVE-2010-4180

Severity Score

3.7

Weakness Type (CWE)

Insufficient Information

NVD-CWE-noinfo

Top Fix

Upgrade Version

Upgrade to version 0.9.8q,1.0.0c

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us