CVE-2009-3555
CriticalSummary
The TLS protocol and SSL 3.0 and earlier versions, used in various products including Microsoft IIS and Apache HTTP Server, improperly associate renegotiation with existing connections. This allows man-in-the-middle attackers to inject data into HTTPS sessions via unauthenticated requests.
Risk Assessment
Organizations may be exposed to attacks that allow data injection into protected sessions, potentially leading to the disclosure of sensitive information or data manipulation.
Recommendation
It is recommended to update software to the latest versions that mitigate this vulnerability and implement additional security measures such as monitoring network traffic.
Original NVD description (English source)
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.