medium6.8Public exploit code
CVE-2014-1771
SChannel in Microsoft Internet Explorer 6 through 11 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renego…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Internet Explorer 9/10 - CFormElement Use-After-Free / Memory Corruption (PoC) (MS14-035)2014-07-08 · dos · windows_x86
Impact
SChannel in Microsoft Internet Explorer 6 through 11 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a "triple handshake attack," aka "TLS Server Certificate Renegotiation Vulnerability."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Internet Explorer | Versions 6, 7, 8, 9, 10, 11 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/67861
- http://www.securitytracker.com/id/1030370
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035
- https://secure-resumption.com/
- http://www.securityfocus.com/bid/67861
- http://www.securitytracker.com/id/1030370
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035
- https://secure-resumption.com/