Note: This is an archival copy of Security Sun Alert 273350 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1021671.1.
Sun Java Enterprise System 5
Sun Java Enterprise System 2005Q4
Solaris 8 Operating System
Solaris 9 Operating System
Solaris 10 Operating System
Date of Workaround Release
Date of Resolved Release
Security Vulnerability in the Transport Layer Security (TLS) and Secure Sockets Layer 3.0 (SSLv3) Protocols Involving Handshake Renegotiation Affects Applications Utilizing Network Security Services (NSS)
A security vulnerability in the Transport Layer Security (TLS) and Secure Sockets Layer 3.0 (SSLv3) protocols in the handling of session renegotiations affects applications utilizing Network Security Services (NSS). This issue may allow a remote unauthenticated user with the ability to intercept and control network traffic to perform a man-in-the-middle (MITM) attack to inject arbitrary plain text at the beginning of an application protocol stream, thus compromising the integrity of the communication. This vulnerability does not allow one to decrypt the intercepted network communication.
Sun acknowledges with thanks, Marsh Ray and Steve Dispensa of PhoneFactor for bringing this issue to our attention.
This issue is also referenced in the following documents:
CVE-2009-3555 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555
US-CERT VU#120541 at http://www.kb.cert.org/vuls/id/120541
2. Contributing Factors
This issue can occur in the following releases:
1. Network Security Services is not shipped with Solaris 8 for x86, so that release is not impacted.
2 . Solaris 8 entered EOSL Phase 2 on 1 April 2009. Entitlement to patches developed on or after 1 April 2009 requires the purchase of the Solaris 8 Vintage Patch Service. See Note in section 5 for more details.
3. Examples of server applications that use Network Security Services (NSS) are Sun Java System Messaging Server, Sun Java System Calendar Server 6 and 7, Sun Convergence, and Sun Java System Communications Express.
4. OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. To determine the base build of OpenSolaris, the following command can be used:
$ uname -vTo determine if NSS packages or patches are installed on a system, follow these instructions:
To determine if the package SUNWtls is installed, the following command may be used:
$ /usr/bin/pkginfo -l SUNWtlsLinux
Linux "sun-nss" packages 3.12.2 and earlier are vulnerable to this issue. To determine if the package "sun-nss" is installed and the version of the installed package, the following command may be used:
$ /bin/rpm -q sun-nssHP-UX
To determine if the package "sun-nss" is installed, the following command may be used:
$ /usr/sbin/swlist sun-nssTo determine which patch level for "sun-nss" is installed, the following command may be used:
$ /usr/sbin/swlist 124379\*Windows
To determine if Sun Java Enterprise System is installed, look into "Add or Remove Programs" from the Control Panel and check if Sun Java(TM) Enterprise System 2005Q4 or Sun Java(TM) Enterprise System 5 is listed as being currently installed.
To determine the list of JES patches installed on the system, the following command may be used:
% <JES installation directory>\utils\patch\ListJavaESPatches.exe3. Symptoms
There are no predictable symptoms that would indicate the described issue has occurred.
There is no workaround for this issue. Please see the Resolution section below.
This issue is addressed for applications that do not depend on TLS session renegotiations in the following releases:
1. If an application depends on renegotiation feature, it can be enabled by setting the environment variable NSS_SSL_ENABLE_RENEGOTIATION to 1. By setting this environmental variable, the fix provided by these patches will have no effect and the application may become vulnerable to the issue.
2. The READMEs of Solaris 8 patches developed on or after 1 April 2009 are available to all customers however Solaris 8 entered EOSL Phase 2 on April 1, 2009 and thus entitlement for these patches, including those that fix security vulnerabilities, requires the purchase of the Solaris 8 Vintage Patch Service. More information about the Solaris 8 Vintage Patch Service is available at:
For more information on Security Sun Alerts, see 1009886.1.
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
09-Dec-2009: Updated Contributing Factors and Resolution sections; now Resolved
12-Jan-2010: Addtional "Note" added in Contributing Factors section
This solution has no attachment