CVE-2015-0205
OpenSSL 1.0.0-1.0.0o and 1.0.1-1.0.1j - Unauthenticated Access via Missing CertificateVerify in DH Authentication
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-0205. PoCs published by saurabh2088.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2015-0205, a vulnerability in OpenSSL 1.0.1g related to the 'FREAK' attack, which allows downgrading TLS connections to export-grade cryptography. The code includes configurations and utilities for testing the vulnerability on various platforms, including MacOS and Netware.
Description
The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.
Exploits (1)
This repository contains a proof-of-concept exploit for CVE-2015-0205, a vulnerability in OpenSSL 1.0.1g related to the 'FREAK' attack, which allows downgrading TLS connections to export-grade cryptography. The code includes configurations and utilities for testing the vulnerability on various platforms, including MacOS and Netware.