Description Preview
The TLS protocol 1.2 and earlier versions support the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType. However, the protocol does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key. This lack of documentation makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate. This vulnerability is also known as the "Key Compromise Impersonation (KCI)" issue.
Overview
The vulnerability was made public on November 8, 2015, and was assigned by Red Hat. It affects the TLS protocol 1.2 and earlier versions. The vulnerability is a significant security risk as it allows man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate.
Remediation
As of now, there is no specific remediation provided for this vulnerability. However, it is generally recommended to keep all software and systems up to date with the latest patches and updates. Regularly updating and patching systems can help to mitigate the risk of vulnerabilities.
References
- [oss-security] 20160920 Re: Possible CVE for TLS protocol issue: http://www.openwall.com/lists/oss-security/2016/09/20/4
- http://twitter.com/matthew_d_green/statuses/630908726950674433
- 93071: http://www.securityfocus.com/bid/93071
- https://security.netapp.com/advisory/ntap-20180626-0002/
- https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf
- https://kcitls.org
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
