1

For the early ChangeCipherSpec attack, the attack would affect client with all version of OpenSSL and server with OpenSSL version 1.0.1 and above.

My question: If two mail servers are communicating with each other, would they be susceptible to such attack (assuming they are using OpenSSL version 1.0.1 and above)

Thanks in advance!

  • 1.0.1 below h, client also 1.0.0 below m and 0.9.8 below za – dave_thompson_085 Aug 29 '14 at 9:25
1

Yes.

In your case, one of the servers plays the role of a SSL client. It initiates a SSL connection and sends mail to another server that plays the role of a SSL server.

From the document that you mentioned in your post:

All versions of OpenSSL are vulnerable on the client side. Only 1.0.1 and above are currently known to be vulnerable on the server side.

Since you are using OpenSSL 1.0.1 and above on both servers, both of them are vulnerable and the system as the whole is susceptible to OpenSSL MITM CCS injection attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.