CVE-2015-3455 Security feature bypass in n/a
Attackers can spoof SSL servers via man-in-the-middle attacks when Squid is configured with client-first SSL-bump due to improper certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3455?
CVE-2015-3455 is a low-severity vulnerability in Fedoraproject Fedora, published on 18 May 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.
Weakness: CWE-20
Which versions are affected by CVE-2015-3455?
It affects 4 products.
Linux distribution packages (6)
squid Red Hat:enterprise_linux:7::server | All versions | 7:3.3.8-26.el7 |
squid-debuginfo Red Hat:enterprise_linux:7::server | All versions | 7:3.3.8-26.el7 |
squid-sysvinit Red Hat:enterprise_linux:7::server | All versions | 7:3.3.8-26.el7 |
squid Red Hat:enterprise_linux:7::workstation | All versions | 7:3.3.8-26.el7 |
squid-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 7:3.3.8-26.el7 |
squid-sysvinit Red Hat:enterprise_linux:7::workstation | All versions | 7:3.3.8-26.el7 |
Products include Fedoraproject Fedora, Oracle Linux, Oracle Solaris, Squid-Cache Squid.
How do I fix CVE-2015-3455?
Upgrade to a fixed version.
Is CVE-2015-3455 being exploited?
There is no known exploitation of CVE-2015-3455 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2015-3455, GHSA-5r9c-4h43-4v5m, MGASA-2015-0191, RHSA-2015:2378, UBUNTU-CVE-2015-3455.