CVE-2003-0192

Vulnerability

A flaw exists in Apache HTTP Server 2 before 2.0.47 and in certain versions of mod_ssl for Apache 1.3. The bug involves improper handling of certain sequences of per-directory renegotiations when the SSLCipherSuite directive is used to upgrade from a weak ciphersuite to a strong one. In affected configurations, the server may incorrectly continue to use the weak ciphersuite instead of enforcing the stronger one, undermining the intended security policy [1][2].

Exploitation

An attacker must be positioned to trigger a TLS renegotiation on a per-directory basis where the configuration attempts to upgrade ciphersuites. No special authentication or write access is required; the exploitation relies on the server's incorrect handling of the renegotiation sequence. The exact steps involve causing the server to renegotiate in a context where the SSLCipherSuite transition is misapplied, leading to the retention of the weaker ciphersuite [1][2].

Impact

Successful exploitation results in the integrity and confidentiality of the HTTPS session being weaker than intended. The attacker may be able to force the server to use a weaker ciphersuite, which could be more susceptible to cryptographic attacks (e.g., eavesdropping or man-in-the-middle). The impact is a downgrade of the negotiated security level, potentially exposing sensitive data [1][2].

Mitigation

Red Hat released updated packages in RHSA-2003:243, RHSA-2003:244, and RHSA-2003:240 to address this issue. Users of Apache HTTP Server should upgrade to Apache 2.0.47 or later, and users of mod_ssl for Apache 1.3 should apply the corresponding updates. Red Hat Enterprise Linux and other affected distributions are covered by these advisories [1][2].