CVE-2021-3618, also known as the ALPACA attack, is a high-severity vulnerability that affects TLS servers implementing different protocols but using compatible certificates. This security flaw allows a man-in-the-middle attacker to redirect traffic between subdomains, breaking the authentication of TLS and potentially enabling cross-protocol attacks. Systems affected include software configurations of F5's Nginx, Sendmail, VSFTPD Project's VSFTPD, and certain Fedora and Debian Linux versions.

How do I know if I'm affected?

To determine if you're affected by the CVE-2021-3618 vulnerability, check if you're using any of the following software configurations: F5 Nginx versions up to (excluding) 1.21.0, Sendmail versions up to (excluding) 8.17, Vsftpd\_project Vsftpd versions up to (excluding) 3.0.4, Fedora versions 33, 34, and 35, or Debian Linux version 10.0. The vulnerability targets TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates.

What should I do if I'm affected?

If you're affected by the CVE-2021-3618 vulnerability, take immediate action to secure your system. Update your software to the latest versions: F5 Nginx to 1.21.0, Sendmail to 8.17, and Vsftpd to 3.0.4. For Fedora and Debian users, apply the relevant security updates. Implement Application Layer Protocol Negotiation (ALPN) and Server Name Indication (SNI) extensions in TLS to prevent cross-protocol attacks. Consult your software vendor for specific guidance and patches.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2021-3618 vulnerability, also known as the ALPACA attack, is not listed in CISA's Known Exploited Vulnerabilities Catalog. The ALPACA attack is a security flaw that can trick a server into thinking it's communicating with a trusted source when it's actually communicating with an attacker. This can lead to sensitive information being exposed or manipulated. The attack is possible due to a flaw in the way some servers handle secure communications.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-295 allowing attackers to redirect traffic and potentially enable cross-protocol attacks.

For more details

CVE-2021-3618, also known as the ALPACA attack, is a significant security vulnerability affecting various software configurations. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and affected software configurations, refer to the NVD page and the resources listed below.

• ALPACA Attack

• Red Hat Bugzilla

• Debian LTS Advisory DLA-3203-1