CVEs-PoC/2015/CVE-2015-0205.md

CVE-2015-0205

Description

The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.

POC

Reference

• http://www.mandriva.com/security/advisories?name=MDVSA-2015:019
• http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
• http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
• http://www.securityfocus.com/bid/91787
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
• https://kc.mcafee.com/corporate/index?page=content&id=SB10102
• https://kc.mcafee.com/corporate/index?page=content&id=SB10108

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Samaritin/OSINT
• https://github.com/chnzzh/OpenSSL-CVE-lib
• https://github.com/neominds/JPN_RIC13351-2
• https://github.com/saurabh2088/OpenSSL_1_0_1g_CVE-2015-0205