FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0885

This CVE name corresponds to:

Entered	Topic
2004-10-23	mod_ssl -- SSLCipherSuite bypass

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2004-0885 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2004-0885
Phase	Assigned(20040922)

Description

The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.

References

Source	Reference
CONFIRM	http://www.apacheweek.com/features/security-20
CONFIRM	http://issues.apache.org/bugzilla/show_bug.cgi?id=31505
CONFIRM	http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
APPLE	APPLE-SA-2005-08-15
APPLE	APPLE-SA-2005-08-17
HP	HPSBUX01123
REDHAT	RHSA-2004:600
REDHAT	RHSA-2004:562
REDHAT	RHSA-2005:816
REDHAT	RHSA-2008:0261
SUNALERT	102198
UBUNTU	USN-177-1
BUGTRAQ	20041015 [OpenPKG-SA-2004.044] OpenPKG Security Advisory (modssl)
BID	11360
OVAL	oval:org.mitre.oval:def:10384
VUPEN	ADV-2006-0789
SECUNIA	19072
XF	apache-sslciphersuite-restriction-bypass(17671)