OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does notproperly restrict processing of ChangeCipherSpec messages during the SSL/TLShandshake. A ChangeCipherSpec message tells the client/server to switch fromunencrypted to encrypted communication. If a ChangeCipherSpec message is sent bythe attacker after the connection is initiated but before the master secret hasbeen generated, OpenSSL will generate the keys for the handshake with an emptymaster secret. This zero-length master key allows an attacker to crack theencryption and consequently obtain sensitive information and/or modify SSL/TLStraffic. Note that an attacker requires a man-in-the-middle position with theclient user in order to exploit this attack.
The second number x.1.z means subject. This second digit, 1 in the previous example, gives generic information where as the third digit (z) gives detail. Unfortunately, I have not cracked the complete code for the second digit. However, I have discovered a few useful patterns, for instance, 5.1.x indicates a problem with the email address, as apposed to server or connector problem. In addition, 5.2.x means that the email is too big, somewhere there is a message limit.
Advanced smtp server 5.2 crack
2ff7e9595c
Comments