what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Masashi Kikuchi

OpenSSL Server-Side ChangeCipherSpec Injection Scanner

Posted Aug 31, 2024

Authored by juan vazquez, Craig Young, Masashi Kikuchi | Site metasploit.com

This Metasploit module checks for the OpenSSL ChangeCipherSpec (CCS) Injection vulnerability. The problem exists in the handling of early CCS messages during session negotiation. Vulnerable installations of OpenSSL accepts them, while later implementations do not. If successful, an attacker can leverage this vulnerability to perform a man-in-the-middle (MITM) attack by downgrading the cipher spec between a client and server. This issue was first reported in early June, 2014.

tags | exploit

advisories | CVE-2014-0224

SHA-256 | 50d2ae16c07b123362ddd9c4123d103a1aaf098f3776f32cfd170977a46bd234

Download | Favorite | View