CVEvulnerability
CVE-2015-2808
3.7 LOW
Official page ↗
- Status
- Modified
- Published
- 2015-04-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-327
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Affected configurations
• oracle communications application session controller (>= 3.0.0 <= 3.9.0)
• oracle communications policy management (< 9.9.2)
• oracle http server 11.1.1.7.0
• oracle http server 11.1.1.9.0
• oracle http server 12.1.3.0.0
• oracle http server 12.2.1.1.0
• oracle http server 12.2.1.2.0
• oracle integrated lights out manager firmware (>= 3.0.0 <= 3.2.11)
• oracle integrated lights out manager firmware (>= 4.0.0 <= 4.0.4)
• debian debian linux 7.0
• debian debian linux 8.0
• redhat satellite 5.7
• redhat enterprise linux desktop 5.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux eus 6.6
• redhat enterprise linux eus 7.1
• redhat enterprise linux eus 7.2
• redhat enterprise linux eus 7.3
• redhat enterprise linux eus 7.4
• redhat enterprise linux eus 7.5
• redhat enterprise linux eus 7.6
• redhat enterprise linux eus 7.7
• redhat enterprise linux server 5.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 6.6
• redhat enterprise linux server aus 7.3
• redhat enterprise linux server aus 7.4
• redhat enterprise linux server aus 7.6
• redhat enterprise linux server aus 7.7
• redhat enterprise linux server tus 7.3
• redhat enterprise linux server tus 7.6
• redhat enterprise linux server tus 7.7
• redhat enterprise linux workstation 5.0
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• suse linux enterprise debuginfo 11
• opensuse opensuse 13.1
• opensuse opensuse 13.2
• suse linux enterprise desktop 11
• suse linux enterprise desktop 12
• suse linux enterprise server 10
• suse linux enterprise server 11
• suse linux enterprise server 12
• suse linux enterprise software development kit 11
• suse linux enterprise software development kit 12
• suse manager 1.7
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 15.04
• redhat satellite 5.6
• fujitsu sparc enterprise m3000 firmware (>= xcp < xcp 1121)
• fujitsu sparc enterprise m4000 firmware (>= xcp < xcp 1121)
• fujitsu sparc enterprise m5000 firmware (>= xcp < xcp 1121)
• fujitsu sparc enterprise m8000 firmware (>= xcp < xcp 1121)
• fujitsu sparc enterprise m9000 firmware (>= xcp < xcp 1121)
• huawei e6000 firmware
• huawei e9000 firmware
• huawei oceanstor 18500 firmware
… and 42 more
Related
Weakness · CWE (1)
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
References
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034 Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727 Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143456209711959&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143629696317098&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143741441012338&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143817021313142&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143817899717054&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143818140118771&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144043644216842&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144059660127919&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144059703728085&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144060576831314&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144060606031437&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144069189622016&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144102017024820&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144104533800819&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144104565600964&w=2 Issue Tracking, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144493176821532&w=2 Issue Tracking, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1006.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1007.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1020.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1021.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1091.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1228.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1229.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1230.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1241.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1242.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1243.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1526.html Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21883640 Third Party Advisory
- http://www-304.ibm.com/support/docview.wss?uid=swg21903565 Third Party Advisory
- http://www-304.ibm.com/support/docview.wss?uid=swg21960015 Third Party Advisory
- http://www-304.ibm.com/support/docview.wss?uid=swg21960769 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3316 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3339 Third Party Advisory
- http://www.huawei.com/en/psirt/security-advisories/hw-454055 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch, Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html Third Party Advisory
- http://www.securityfocus.com/bid/73684 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/91787 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032599 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032600 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032707 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032708 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032734 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032788 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032858 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032868 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032910 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032990 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033071 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033072 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033386 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033415 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033431 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033432 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033737 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1033769 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1036222 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2696-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2706-1 Third Party Advisory