Vulnerabilities in SSL & TLS :- CCS injection vulnerability

Main Points

• A weakness exists within a certain version of OpenSSL that allows clients and servers to be forced via specifically specially crafted handshake packet to use weak key material for communication.
• Via a person-in-the-middle context an attacker maybe able to decrypt/modify traffic.

Quick Reference

Description

A weakness in certain versions of OpenSSL that allows an attacker to use weak key material for communication with the hope decrypting traffic later.

Name

CCS injection vulnerability

CVE Number

CVE-2014-0224

Type of Vulnerability

Vulnerability in the OpenSSL library.

Affected

OpenSSL versions said to be affected include:

• Versions before 0.9.8za
• 1.0.0 before 1.0.0m
• 1.0.1 before 1.0.1h

Remediation

Upgrade to a non-vulnerable version of the OpenSSL Library.