OpenSSL ‘ChangeCipherSpec’ (CCS) MiTM Vulnerability

The OpenSSL service on the remote host is vulnerable to a man-in-the-middle (MiTM) attack, based on its acceptance of a specially crafted handshake. This flaw could allow a MiTM attacker to decrypt or forge SSL messages by telling the service to begin encrypted communications before key material has been exchanged, which causes predictable keys to be used to secure future traffic.

Two factors are important to consider the risk of this vulnerability:
1. An attacker must a MiTM vector (e.g. physical network access between the client and server).
2. The client and server both must use vulnerable versions of OpenSSL. Most major desktop versions of web browsers (Chrome, Firefox, and IE, do not use OpenSSL)

The original advisory for this vulnerability can be found at the following URL: https://www.openssl.org/news/secadv_20140605.txt

Remediation

OpenSSL should be upgraded to the latest stable version. Instances of this issue are often a result of other software that is bundled with outdated versions of SSL. These products should be upgraded individually and verified the OpenSSL versions are up to date.

The latest version of OpenSSL can be found at the following URL: https://www.openssl.org/source/