File tree Expand file tree Collapse file tree 1 file changed +3
-3
lines changed
modules/auxiliary/scanner/ssl Expand file tree Collapse file tree 1 file changed +3
-3
lines changed Original file line number Diff line number Diff line change @@ -79,9 +79,9 @@ def initialize
79
79
super (
80
80
'Name' => 'OpenSSL Server-Side ChangeCipherSpec Injection Scanner' ,
81
81
'Description' => %q{
82
- This module checks for the OpenSSL ChageCipherSpec (CCS)
82
+ This module checks for the OpenSSL ChangeCipherSpec (CCS)
83
83
Injection vulnerability. The problem exists in the handling of early
84
- CCS messages during session negotation . Vulnerable installations of OpenSSL accepts
84
+ CCS messages during session negotiation . Vulnerable installations of OpenSSL accepts
85
85
them, while later implementations do not. If successful, an attacker can leverage this
86
86
vulnerability to perform a man-in-the-middle (MITM) attack by downgrading the cipher spec
87
87
between a client and server. This issue was first reported in early June, 2014.
@@ -131,7 +131,7 @@ def ccs_injection
131
131
sock . put ( ccs )
132
132
alert = sock . get_once ( -1 , response_timeout )
133
133
if alert . blank?
134
- print_good ( "#{ peer } - No alert after invalid CSS message, probably vulnerable" )
134
+ print_good ( "#{ peer } - No alert after invalid CCS message, probably vulnerable" )
135
135
report
136
136
elsif alert . unpack ( "C" ) . first == ALERT_RECORD_TYPE
137
137
vprint_error ( "#{ peer } - Alert record as response to the invalid CCS Message, probably not vulnerable" )
You can’t perform that action at this time.
0 commit comments