01 Record

CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before

CriticalPUBLISHEDCNA: redhat

CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before

03 Exploitation and scoring

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

87.26% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 99.7% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-16.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2009-11-09 17:00Z16 YR AGO

Last updated

2026-05-27 15:38Z3 MO AGO

Reserved

2009-10-05

Assigning CNA

redhat

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-300Channel Accessible by Non-EndpointClass
CWE-295Improper Certificate ValidationBase

Data version

5.2

Document digest

2b0f8e57f5de0db89ce5216c8cb0d6a9abde28d4c6848f9fb0b5dfddefd6ecb8

05 Affected products

VendorProductVersionsPlatforms

apachehttp_serverNot specified—

canonicalubuntu_linuxNot specified—

debiandebian_linuxNot specified—

f5nginxNot specified—

fedoraprojectfedoraNot specified—

gnugnutlsNot specified—

mozillanssNot specified—

opensslopensslNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_enterprise_web_serverNot specified—

redhatnetwork_satelliteNot specified—

redhatrhel_extrasNot specified—

redhatrhel_extras_sapNot specified—

redhatsatelliteNot specified—

redhatsatellite_capsuleNot specified—

06 References

lists.apple.comAPPLE-SA-2010-05-18-1http://lists.apple.com/archives/security-announce/2010//May/msg00001.htmlvendor-advisoryx_refsource_APPLE
www.securitytracker.com1023427http://www.securitytracker.com/id?1023427vdb-entryx_refsource_SECTRACK
support.avaya.comhttp://support.avaya.com/css/P8/documents/100081611x_refsource_CONFIRM
osvdb.org62210http://osvdb.org/62210vdb-entryx_refsource_OSVDB
secunia.com37640http://secunia.com/advisories/37640third-party-advisoryx_refsource_SECUNIA
www.arubanetworks.comhttp://www.arubanetworks.com/support/alerts/aid-020810.txtx_refsource_CONFIRM
www.vupen.comADV-2010-0916http://www.vupen.com/english/advisories/2010/0916vdb-entryx_refsource_VUPEN
support.avaya.comhttp://support.avaya.com/css/P8/documents/100114327x_refsource_CONFIRM
www.redhat.comRHSA-2010:0167http://www.redhat.com/support/errata/RHSA-2010-0167.htmlvendor-advisoryx_refsource_REDHAT
www.vupen.comADV-2010-2010http://www.vupen.com/english/advisories/2010/2010vdb-entryx_refsource_VUPEN
www.redhat.comFEDORA-2009-12750https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.htmlvendor-advisoryx_refsource_FEDORA
www.vupen.comADV-2010-0086http://www.vupen.com/english/advisories/2010/0086vdb-entryx_refsource_VUPEN
www.vupen.comADV-2010-1673http://www.vupen.com/english/advisories/2010/1673vdb-entryx_refsource_VUPEN
www.ietf.org[tls] 20091104 TLS renegotiation issuehttp://www.ietf.org/mail-archive/web/tls/current/msg03948.htmlmailing-listx_refsource_MLIST
secunia.com37656http://secunia.com/advisories/37656third-party-advisoryx_refsource_SECUNIA
www.redhat.comRHSA-2010:0865http://www.redhat.com/support/errata/RHSA-2010-0865.htmlvendor-advisoryx_refsource_REDHAT
secunia.com39628http://secunia.com/advisories/39628third-party-advisoryx_refsource_SECUNIA
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.htmlx_refsource_CONFIRM
secunia.com42724http://secunia.com/advisories/42724third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2009-3310http://www.vupen.com/english/advisories/2009/3310vdb-entryx_refsource_VUPEN
www.vupen.comADV-2009-3205http://www.vupen.com/english/advisories/2009/3205vdb-entryx_refsource_VUPEN
blogs.sun.comhttp://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_duringx_refsource_CONFIRM
secunia.com39461http://secunia.com/advisories/39461third-party-advisoryx_refsource_SECUNIA
support.avaya.comhttp://support.avaya.com/css/P8/documents/100114315x_refsource_CONFIRM
www.proftpd.orghttp://www.proftpd.org/docs/RELEASE_NOTES-1.3.2cx_refsource_CONFIRM
security.gentoo.orgGLSA-201406-32http://security.gentoo.org/glsa/glsa-201406-32.xmlvendor-advisoryx_refsource_GENTOO
www.ingate.comhttp://www.ingate.com/Relnote.php?ver=481x_refsource_CONFIRM
www.securitytracker.com1023204http://www.securitytracker.com/id?1023204vdb-entryx_refsource_SECTRACK
secunia.com40866http://secunia.com/advisories/40866third-party-advisoryx_refsource_SECUNIA
marc.infoHPSBMU02799http://marc.info/?l=bugtraq&m=134254866602253&w=2vendor-advisoryx_refsource_HP
www.us-cert.govTA10-222Ahttp://www.us-cert.gov/cas/techalerts/TA10-222A.htmlthird-party-advisoryx_refsource_CERT
www.securitytracker.com1023211http://www.securitytracker.com/id?1023211vdb-entryx_refsource_SECTRACK
h20000.www2.hp.comSSRT090249http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686vendor-advisoryx_refsource_HP
secunia.com39317http://secunia.com/advisories/39317third-party-advisoryx_refsource_SECUNIA
www.securitytracker.com1023212http://www.securitytracker.com/id?1023212vdb-entryx_refsource_SECTRACK
lists.opensuse.orgSUSE-SA:2010:061http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.htmlvendor-advisoryx_refsource_SUSE
secunia.com39127http://secunia.com/advisories/39127third-party-advisoryx_refsource_SECUNIA
secunia.com40545http://secunia.com/advisories/40545third-party-advisoryx_refsource_SECUNIA
www.vupen.comADV-2010-3069http://www.vupen.com/english/advisories/2010/3069vdb-entryx_refsource_VUPEN
openbsd.org[4.5] 010: SECURITY FIX: November 26, 2009http://openbsd.org/errata45.html#010_opensslvendor-advisoryx_refsource_OPENBSD
www.securitytracker.com1023210http://www.securitytracker.com/id?1023210vdb-entryx_refsource_SECTRACK
www.securitytracker.com1023270http://www.securitytracker.com/id?1023270vdb-entryx_refsource_SECTRACK
secunia.com40070http://secunia.com/advisories/40070third-party-advisoryx_refsource_SECUNIA
www.securitytracker.com1023273http://www.securitytracker.com/id?1023273vdb-entryx_refsource_SECTRACK
kbase.redhat.comhttp://kbase.redhat.com/faq/docs/DOC-20491x_refsource_CONFIRM
www.ubuntu.comUSN-927-5http://www.ubuntu.com/usn/USN-927-5vendor-advisoryx_refsource_UBUNTU
www-01.ibm.comPM12247http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247vendor-advisoryx_refsource_AIXAPAR
lists.opensuse.orgSUSE-SU-2011:0847http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.htmlvendor-advisoryx_refsource_SUSE
www.mandriva.comMDVSA-2010:089http://www.mandriva.com/security/advisories?name=MDVSA-2010:089vendor-advisoryx_refsource_MANDRIVA
www.redhat.comRHSA-2010:0770http://www.redhat.com/support/errata/RHSA-2010-0770.htmlvendor-advisoryx_refsource_REDHAT
www.openssl.orghttp://www.openssl.org/news/secadv_20091111.txtx_refsource_CONFIRM
www.securitytracker.com1023275http://www.securitytracker.com/id?1023275vdb-entryx_refsource_SECTRACK
www.debian.orgDSA-3253http://www.debian.org/security/2015/dsa-3253vendor-advisoryx_refsource_DEBIAN
www.vupen.comADV-2009-3484http://www.vupen.com/english/advisories/2009/3484vdb-entryx_refsource_VUPEN
www.securitytracker.com1023207http://www.securitytracker.com/id?1023207vdb-entryx_refsource_SECTRACK
secunia.com37859http://secunia.com/advisories/37859third-party-advisoryx_refsource_SECUNIA
marc.infoSSRT101846http://marc.info/?l=bugtraq&m=142660345230545&w=2vendor-advisoryx_refsource_HP
sunsolve.sun.com1021752http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1vendor-advisoryx_refsource_SUNALERT
lists.fedoraproject.orgFEDORA-2010-6131http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.htmlvendor-advisoryx_refsource_FEDORA
www.vupen.comADV-2010-0848http://www.vupen.com/english/advisories/2010/0848vdb-entryx_refsource_VUPEN
www.openwall.com[oss-security] 20091107 Re: [TLS] CVE-2009-3555 for TLS renegotiation MITM attackshttp://www.openwall.com/lists/oss-security/2009/11/07/3mailing-listx_refsource_MLIST
secunia.com39819http://secunia.com/advisories/39819third-party-advisoryx_refsource_SECUNIA
www-01.ibm.comIC68055http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055vendor-advisoryx_refsource_AIXAPAR
www.links.orghttp://www.links.org/?p=786x_refsource_MISC
osvdb.org60521http://osvdb.org/60521vdb-entryx_refsource_OSVDB
www.openwall.com[oss-security] 20091123 Re: CVEs for nginxhttp://www.openwall.com/lists/oss-security/2009/11/23/10mailing-listx_refsource_MLIST
www.kb.cert.orgVU#120541http://www.kb.cert.org/vuls/id/120541third-party-advisoryx_refsource_CERT-VN
www.securitytracker.com1023217http://www.securitytracker.com/id?1023217vdb-entryx_refsource_SECTRACK
www.redhat.comRHSA-2010:0768http://www.redhat.com/support/errata/RHSA-2010-0768.htmlvendor-advisoryx_refsource_REDHAT
www.vupen.comADV-2009-3353http://www.vupen.com/english/advisories/2009/3353vdb-entryx_refsource_VUPEN
lists.fedoraproject.orgFEDORA-2010-5357http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.htmlvendor-advisoryx_refsource_FEDORA
secunia.com39136http://secunia.com/advisories/39136third-party-advisoryx_refsource_SECUNIA
www.openoffice.orghttp://www.openoffice.org/security/cves/CVE-2009-3555.htmlx_refsource_CONFIRM
www.vupen.comADV-2011-0032http://www.vupen.com/english/advisories/2011/0032vdb-entryx_refsource_VUPEN
securitytracker.com1023148http://securitytracker.com/id?1023148vdb-entryx_refsource_SECTRACK
lists.opensuse.orgopenSUSE-SU-2011:0845http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.htmlvendor-advisoryx_refsource_SUSE
www.securityfocus.com36935http://www.securityfocus.com/bid/36935vdb-entryx_refsource_BID
www.tombom.co.ukhttp://www.tombom.co.uk/blog/?p=85x_refsource_MISC
marc.infoSSRT090208http://marc.info/?l=bugtraq&m=130497311408250&w=2vendor-advisoryx_refsource_HP
www.vupen.comADV-2010-1107http://www.vupen.com/english/advisories/2010/1107vdb-entryx_refsource_VUPEN
www.securitytracker.com1023218http://www.securitytracker.com/id?1023218vdb-entryx_refsource_SECTRACK
www.vupen.comADV-2010-1350http://www.vupen.com/english/advisories/2010/1350vdb-entryx_refsource_VUPEN
www.redhat.comRHSA-2010:0338http://www.redhat.com/support/errata/RHSA-2010-0338.htmlvendor-advisoryx_refsource_REDHAT
secunia.com42379http://secunia.com/advisories/42379third-party-advisoryx_refsource_SECUNIA
www.redhat.comFEDORA-2009-12775https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.htmlvendor-advisoryx_refsource_FEDORA
www.cisco.com20091109 Transport Layer Security Renegotiation Vulnerabilityhttp://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtmlvendor-advisoryx_refsource_CISCO
www-01.ibm.comIC67848http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848vendor-advisoryx_refsource_AIXAPAR
www.securitytracker.com1023213http://www.securitytracker.com/id?1023213vdb-entryx_refsource_SECTRACK
lists.fedoraproject.orgFEDORA-2010-16240http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.htmlvendor-advisoryx_refsource_FEDORA
www.vupen.comADV-2010-1793http://www.vupen.com/english/advisories/2010/1793vdb-entryx_refsource_VUPEN
oval.cisecurity.orgoval:org.mitre.oval:def:11617https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617vdb-entrysignaturex_refsource_OVAL
extendedsubset.comhttp://extendedsubset.com/?p=8x_refsource_MISC
secunia.com37292http://secunia.com/advisories/37292third-party-advisoryx_refsource_SECUNIA
www.securityfocus.comSSRT100817http://www.securityfocus.com/archive/1/522176vendor-advisoryx_refsource_HP
exchange.xforce.ibmcloud.comtls-renegotiation-weak-security(54158)https://exchange.xforce.ibmcloud.com/vulnerabilities/54158vdb-entryx_refsource_XF
lists.apple.comAPPLE-SA-2010-05-18-2http://lists.apple.com/archives/security-announce/2010//May/msg00002.htmlvendor-advisoryx_refsource_APPLE
secunia.com39278http://secunia.com/advisories/39278third-party-advisoryx_refsource_SECUNIA
www.securitytracker.com1023205http://www.securitytracker.com/id?1023205vdb-entryx_refsource_SECTRACK
www.redhat.comRHSA-2010:0130http://www.redhat.com/support/errata/RHSA-2010-0130.htmlvendor-advisoryx_refsource_REDHAT
tomcat.apache.orghttp://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.htmlx_refsource_CONFIRM
support.apple.comhttp://support.apple.com/kb/HT4004x_refsource_CONFIRM
www.securitytracker.com1023215http://www.securitytracker.com/id?1023215vdb-entryx_refsource_SECTRACK
www.ubuntu.comUSN-1010-1http://www.ubuntu.com/usn/USN-1010-1vendor-advisoryx_refsource_UBUNTU
www.securitytracker.com1023206http://www.securitytracker.com/id?1023206vdb-entryx_refsource_SECTRACK
lists.opensuse.orgSUSE-SR:2010:011http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlvendor-advisoryx_refsource_SUSE
h20566.www2.hpe.comhttps://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888x_refsource_CONFIRM
security.gentoo.orgGLSA-200912-01http://security.gentoo.org/glsa/glsa-200912-01.xmlvendor-advisoryx_refsource_GENTOO
marc.infoSSRT090180http://marc.info/?l=bugtraq&m=127419602507642&w=2vendor-advisoryx_refsource_HP
www.vupen.comADV-2009-3313http://www.vupen.com/english/advisories/2009/3313vdb-entryx_refsource_VUPEN
sunsolve.sun.com274990http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1vendor-advisoryx_refsource_SUNALERT
www.securitytracker.com1023208http://www.securitytracker.com/id?1023208vdb-entryx_refsource_SECTRACK
secunia.com43308http://secunia.com/advisories/43308third-party-advisoryx_refsource_SECUNIA
www.securitytracker.com1023214http://www.securitytracker.com/id?1023214vdb-entryx_refsource_SECTRACK
lists.opensuse.orgSUSE-SA:2009:057http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.htmlvendor-advisoryx_refsource_SUSE
secunia.com38781http://secunia.com/advisories/38781third-party-advisoryx_refsource_SECUNIA
marc.infoHPSBOV02762http://marc.info/?l=bugtraq&m=133469267822771&w=2vendor-advisoryx_refsource_HP
www.debian.orgDSA-1934http://www.debian.org/security/2009/dsa-1934vendor-advisoryx_refsource_DEBIAN
www.redhat.comFEDORA-2009-12782https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.htmlvendor-advisoryx_refsource_FEDORA
oval.cisecurity.orgoval:org.mitre.oval:def:7478https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478vdb-entrysignaturex_refsource_OVAL
www.securitytracker.com1023271http://www.securitytracker.com/id?1023271vdb-entryx_refsource_SECTRACK
lists.apple.comAPPLE-SA-2010-01-19-1http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.htmlvendor-advisoryx_refsource_APPLE
marc.info[cryptography] 20091105 OpenSSL 0.9.8l releasedhttp://marc.info/?l=cryptography&m=125752275331877&w=2mailing-listx_refsource_MLIST
secunia.com42467http://secunia.com/advisories/42467third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com20091130 TLS / SSLv3 vulnerability explained (New ways to leverage the vulnerability)http://www.securityfocus.com/archive/1/508130/100/0/threadedmailing-listx_refsource_BUGTRAQ
oval.cisecurity.orgoval:org.mitre.oval:def:7315https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315vdb-entrysignaturex_refsource_OVAL
www.securitytracker.com1023224http://www.securitytracker.com/id?1023224vdb-entryx_refsource_SECTRACK
lists.opensuse.orgSUSE-SR:2010:013http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlvendor-advisoryx_refsource_SUSE
www.ubuntu.comUSN-927-4http://www.ubuntu.com/usn/USN-927-4vendor-advisoryx_refsource_UBUNTU
secunia.com41490http://secunia.com/advisories/41490third-party-advisoryx_refsource_SECUNIA
www.securityfocus.com20091124 rPSA-2009-0155-1 httpd mod_sslhttp://www.securityfocus.com/archive/1/508075/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.securitytracker.com1023243http://www.securitytracker.com/id?1023243vdb-entryx_refsource_SECTRACK
blog.g-sec.luhttp://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.htmlx_refsource_MISC
secunia.com37504http://secunia.com/advisories/37504third-party-advisoryx_refsource_SECUNIA
www.securitytracker.com1023219http://www.securitytracker.com/id?1023219vdb-entryx_refsource_SECTRACK
sysoev.ruhttp://sysoev.ru/nginx/patch.cve-2009-3555.txtx_refsource_CONFIRM
xss.cxhttp://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.htmlx_refsource_MISC
www.securitytracker.com1023163http://www.securitytracker.com/id?1023163vdb-entryx_refsource_SECTRACK
marc.infoHPSBHF02706http://marc.info/?l=bugtraq&m=132077688910227&w=2vendor-advisoryx_refsource_HP
www.vupen.comADV-2009-3521http://www.vupen.com/english/advisories/2009/3521vdb-entryx_refsource_VUPEN
oval.cisecurity.orgoval:org.mitre.oval:def:7973https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973vdb-entrysignaturex_refsource_OVAL
www.itrc.hp.comHPSBMA02568http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995vendor-advisoryx_refsource_HP
support.zeus.comhttp://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_releasedx_refsource_CONFIRM
bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=533125x_refsource_CONFIRM
oval.cisecurity.orgoval:org.mitre.oval:def:10088https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088vdb-entrysignaturex_refsource_OVAL
secunia.com44183http://secunia.com/advisories/44183third-party-advisoryx_refsource_SECUNIA
support.zeus.comhttp://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTESx_refsource_CONFIRM
secunia.com42808http://secunia.com/advisories/42808third-party-advisoryx_refsource_SECUNIA
secunia.com39500http://secunia.com/advisories/39500third-party-advisoryx_refsource_SECUNIA
oval.cisecurity.orgoval:org.mitre.oval:def:11578https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578vdb-entrysignaturex_refsource_OVAL
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.htmlx_refsource_CONFIRM
www.vupen.comADV-2009-3220http://www.vupen.com/english/advisories/2009/3220vdb-entryx_refsource_VUPEN
itrc.hp.comSSRT100179http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751vendor-advisoryx_refsource_HP
marc.infoSSRT100089http://marc.info/?l=bugtraq&m=127557596201693&w=2vendor-advisoryx_refsource_HP
www.redhat.comRHSA-2010:0165http://www.redhat.com/support/errata/RHSA-2010-0165.htmlvendor-advisoryx_refsource_REDHAT
www.securityfocus.com20101207 VMSA-2010-0019 VMware ESX third party updates for Service Consolehttp://www.securityfocus.com/archive/1/515055/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.redhat.comRHSA-2010:0987http://www.redhat.com/support/errata/RHSA-2010-0987.htmlvendor-advisoryx_refsource_REDHAT
bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=545755x_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21426108x_refsource_CONFIRM
blogs.iss.nethttp://blogs.iss.net/archive/sslmitmiscsrf.htmlx_refsource_MISC
www.securitytracker.com1023411http://www.securitytracker.com/id?1023411vdb-entryx_refsource_SECTRACK
www.redhat.comRHSA-2010:0339http://www.redhat.com/support/errata/RHSA-2010-0339.htmlvendor-advisoryx_refsource_REDHAT
www.redhat.comRHSA-2010:0986http://www.redhat.com/support/errata/RHSA-2010-0986.htmlvendor-advisoryx_refsource_REDHAT
www.vupen.comADV-2009-3164http://www.vupen.com/english/advisories/2009/3164vdb-entryx_refsource_VUPEN
secunia.com37383http://secunia.com/advisories/37383third-party-advisoryx_refsource_SECUNIA
www.redhat.comFEDORA-2009-12229https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.htmlvendor-advisoryx_refsource_FEDORA
secunia.com44954http://secunia.com/advisories/44954third-party-advisoryx_refsource_SECUNIA
www.ietf.org[tls] 20091104 MITM attack on delayed TLS-client auth through renegotiationhttp://www.ietf.org/mail-archive/web/tls/current/msg03928.htmlmailing-listx_refsource_MLIST
support.avaya.comhttp://support.avaya.com/css/P8/documents/100070150x_refsource_CONFIRM
secunia.com40747http://secunia.com/advisories/40747third-party-advisoryx_refsource_SECUNIA
marc.infoHPSBUX02498http://marc.info/?l=bugtraq&m=126150535619567&w=2vendor-advisoryx_refsource_HP
secunia.com39292http://secunia.com/advisories/39292third-party-advisoryx_refsource_SECUNIA
secunia.com42816http://secunia.com/advisories/42816third-party-advisoryx_refsource_SECUNIA
www-01.ibm.comIC68054http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054vendor-advisoryx_refsource_AIXAPAR
sunsolve.sun.com273029http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1vendor-advisoryx_refsource_SUNALERT
www.redhat.comFEDORA-2009-12604https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.htmlvendor-advisoryx_refsource_FEDORA
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21432298x_refsource_CONFIRM
extendedsubset.comhttp://extendedsubset.com/Renegotiating_TLS.pdfx_refsource_MISC
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg24025312x_refsource_CONFIRM
www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg24006386x_refsource_CONFIRM
support.apple.comhttp://support.apple.com/kb/HT4170x_refsource_CONFIRM
www.securityfocus.com20091118 TLS / SSLv3 vulnerability explained (DRAFT)http://www.securityfocus.com/archive/1/507952/100/0/threadedmailing-listx_refsource_BUGTRAQ
www.securitytracker.com1023209http://www.securitytracker.com/id?1023209vdb-entryx_refsource_SECTRACK
www-1.ibm.comPM00675http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=onlyvendor-advisoryx_refsource_AIXAPAR
www.vmware.comhttp://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlx_refsource_CONFIRM
secunia.com48577http://secunia.com/advisories/48577third-party-advisoryx_refsource_SECUNIA
slackware.comSSA:2009-320-01http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446vendor-advisoryx_refsource_SLACKWARE
www.links.orghttp://www.links.org/?p=789x_refsource_MISC
www.opera.comhttp://www.opera.com/docs/changelogs/unix/1060/x_refsource_CONFIRM
www.securegoose.orghttp://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.htmlx_refsource_MISC
www.redhat.comRHSA-2011:0880http://www.redhat.com/support/errata/RHSA-2011-0880.htmlvendor-advisoryx_refsource_REDHAT
lists.opensuse.orgSUSE-SR:2010:008http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.htmlvendor-advisoryx_refsource_SUSE
www.oracle.comhttp://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.htmlx_refsource_CONFIRM
www.openwall.com[oss-security] 20091107 Re: CVE-2009-3555 for TLS renegotiation MITM attackshttp://www.openwall.com/lists/oss-security/2009/11/06/3mailing-listx_refsource_MLIST
www.redhat.comFEDORA-2009-12305https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.htmlvendor-advisoryx_refsource_FEDORA
wiki.rpath.comhttp://wiki.rpath.com/Advisories:rPSA-2009-0155x_refsource_CONFIRM
lists.opensuse.orgSUSE-SR:2010:012http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.htmlvendor-advisoryx_refsource_SUSE
support.citrix.comhttp://support.citrix.com/article/CTX123359x_refsource_CONFIRM
secunia.com37501http://secunia.com/advisories/37501third-party-advisoryx_refsource_SECUNIA
www.mandriva.comMDVSA-2010:076http://www.mandriva.com/security/advisories?name=MDVSA-2010:076vendor-advisoryx_refsource_MANDRIVA
marc.infoHPSBUX02517http://marc.info/?l=bugtraq&m=127128920008563&w=2vendor-advisoryx_refsource_HP

01 Record index

CVE-2009-3555

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2009-3555

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References