CEH Footprinting, Reconnaissance and Scanning Practice Question

During a vulnerability scan using Nessus, a security analyst discovers that the target host shows a 'High' severity vulnerability for 'SSL/TLS Renegotiation DoS'. What does this vulnerability indicate?

⚠ Common exam trap

Test-takers frequently confuse this DoS vulnerability with weak cipher suites or protocol version issues, but the core distinction is that renegotiation DoS is about resource exhaustion from repeated handshakes, not about encryption strength or certificate trust.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

An attacker can force the server to renegotiate TLS handshakes repeatedly, causing resource exhaustion

The SSL/TLS Renegotiation DoS vulnerability (CVE-2011-1473) occurs when a server supports TLS renegotiation without proper rate limiting. An attacker can open multiple connections and repeatedly request renegotiation, causing the server to consume excessive CPU resources for cryptographic handshake calculations, effectively leading to a denial of service. Nessus flags this as 'High' severity because it can exhaust server resources even with a single attacker.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The server does not validate SSL certificates
Why it's wrong here
This vulnerability refers to a client's failure to verify the authenticity and validity of a server's SSL/TLS certificate during the initial handshake or subsequent renegotiations. While critical for preventing man-in-the-middle attacks and ensuring trust, it is distinct from the SSL/TLS Renegotiation DoS, which exploits the computational cost of repeated renegotiation handshakes rather than issues with certificate trust or validation itself. A server not validating client certificates (in mutual TLS) or a client not validating server certificates are different security concerns.
✗
The server supports SSLv2
Why it's wrong here
Supporting SSLv2 is indeed a significant vulnerability due to its inherent cryptographic weaknesses, such such as weak key derivation, lack of message authentication, and susceptibility to protocol downgrade attacks. However, this specific issue is about using an outdated, insecure protocol version, whereas the renegotiation DoS vulnerability targets the resource-intensive process of establishing new secure sessions or rekeying existing ones, which affects both SSL and modern TLS protocols.
✗
The server allows weak cipher suites
Why it's wrong here
Allowing weak cipher suites means the server is configured to use cryptographic algorithms that are no longer considered secure, making the encrypted communication susceptible to decryption by an attacker. Examples include RC4, DES, or those with short key lengths. This vulnerability compromises the confidentiality and integrity of data, but it is fundamentally different from the SSL/TLS Renegotiation DoS, which exploits the server's CPU and memory resources during the handshake process itself, regardless of the strength of the ciphers eventually negotiated.
✓
An attacker can force the server to renegotiate TLS handshakes repeatedly, causing resource exhaustion
Why this is correct
This option accurately describes the SSL/TLS Renegotiation DoS vulnerability, where an attacker initiates numerous partial TLS handshakes, specifically requesting renegotiation of the secure channel. Each renegotiation requires significant computational effort from the server, involving cryptographic operations like key exchanges and certificate validations. By repeatedly forcing these resource-intensive operations, an attacker can exhaust the server's CPU and memory, leading to a denial of service for legitimate users.

Go deeper

CEH Footprinting, Reconnaissance and Scanning Practice Question

Why each option matters

Option-by-option breakdown

Related to this question