CVE-2010-4180— OpenSSL 加密问题漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

存在公开或 AI PoC，应优先验证

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 0.9.8q之前版本、1.0.x版本至1.0.0c之前版本存在加密问题漏洞，该漏洞源于不能正确阻止修改会话缓存中的密码套件。

CVE-2010-4180 影响 n/a n/a。存在公开或 AI PoC，应优先验证。OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 0.9.8q之前版本、1.0.x版本至1.0.0c之前版本存在加密问题漏洞，该漏洞源于不能正确阻止修改会话缓存中的密码套件。 CVE-2010-4180 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2010-4180

一、 漏洞 CVE-2010-4180 基础信息

受影响产品

二、漏洞 CVE-2010-4180 的公开POC

三、漏洞 CVE-2010-4180 的情报信息

CVE-2010-4180 厂商安全公告 (30)

• http://support.apple.com/kb/HT4723 x_refsource_CONFIRM
• https://bugzilla.redhat.com/show_bug.cgi?id=659462 x_refsource_CONFIRM
• http://secunia.com/advisories/42620 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42493 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/43173 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/45164 vdb-entry x_refsource_BID
• http://osvdb.org/69565 vdb-entry x_refsource_OSVDB
• http://secunia.com/advisories/42473 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/44269 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/43170 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/43171 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42571 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/43172 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42811 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/43169 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42877 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/42469 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1024822 vdb-entry x_refsource_SECTRACK
• http://www.kb.cert.org/vuls/id/737740 third-party-advisory x_refsource_CERT-VN
• http://www.securityfocus.com/archive/1/522176 vendor-advisory x_refsource_HP
• http://www.vupen.com/english/advisories/2010/3188 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2010/3120 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2010/3122 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0076 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2010/3134 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0268 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2011/0032 vdb-entry x_refsource_VUPEN
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:248 vendor-advisory x_refsource_MANDRIVA
• 🔗 The Slackware Linux Project: Slackware Security Advisories 查看完整文章 vendor-advisory x_refsource_SLACKWARE
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18910 vdb-entry signature x_refsource_OVAL

CVE-2010-4180 邮件列表归档 (10)

• http://marc.info/?l=bugtraq&m=130497251507577&w=2 vendor-advisory x_refsource_HP
• http://marc.info/?l=bugtraq&m=129916880600544&w=2 vendor-advisory x_refsource_HP
• http://marc.info/?l=bugtraq&m=132077688910227&w=2 vendor-advisory x_refsource_HP
• http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html vendor-advisory x_refsource_SUSE
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052315.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052027.html vendor-advisory x_refsource_FEDORA
• http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html vendor-advisory x_refsource_SUSE
• http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html vendor-advisory x_refsource_APPLE
• http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html vendor-advisory x_refsource_SUSE

CVE-2010-4180 其他参考 (8)

• http://openssl.org/news/secadv_20101202.txt x_refsource_CONFIRM
• https://kb.bluecoat.com/index?page=content&id=SA53&actp=LIST x_refsource_CONFIRM
• http://cvs.openssl.org/chngview?cn=20131 x_refsource_CONFIRM
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777 vendor-advisory x_refsource_HP
• http://www.redhat.com/support/errata/RHSA-2011-0896.html vendor-advisory x_refsource_REDHAT
• http://www.redhat.com/support/errata/RHSA-2010-0979.html vendor-advisory x_refsource_REDHAT
• http://www.redhat.com/support/errata/RHSA-2010-0978.html vendor-advisory x_refsource_REDHAT
• http://www.redhat.com/support/errata/RHSA-2010-0977.html vendor-advisory x_refsource_REDHAT

• https://www.cve.org/CVERecord?id=CVE-2010-4180

同批安全公告 · n/a · 2010-12-06 · 共 17 条

IV. Related Vulnerabilities

V. Comments for CVE-2010-4180