Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2015-2808

Overview

Vulnerability Score 4.3 4.3
CVE Id CVE-2015-2808
Last Modified 17 Aug 2015 10:00:37
Published 31 Mar 2015 10:00:35
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact NONE NONE
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity MEDIUM
Authentication NONE

CVE-2015-2808

Summary

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Vulnerable Systems

Application

  • Apple Safari

  • Google Chrome -

  • Ibm Websphere Application Server

  • Jboss Enterprise Application Server

  • Microsoft Ie

  • Microsoft Iis

  • Mozilla Firefox

  • Opera Browser -

  • Oracle Glassfish

  • Sun Glassfish Enterprise Server


References

MISC - https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf

HP - SSRT102102

CONFIRM - http://www-01.ibm.com/support/docview.wss?uid=swg21883640

AIXAPAR - IV71892

AIXAPAR - IV71888

CONFIRM - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

HP - SSRT102127

HP - SSRT102129

HP - SSRT102133

HP - SSRT102150

Related Patches

SUN125136-97 Solaris 10 SPARC: JavaSE 6: update 101 patch (equivalent to JDK 6u101)

SUN125137-97 Solaris 10 SPARC: JavaSE 6: update 101 patch (equivalent to JDK 6u101), 64bit

SUN125138-97 Solaris 10 x86: JavaSE 6: update 101 patch (equivalent to JDK 6u101)

SUN125139-97 Solaris 10 x86: JavaSE 6: update 101 patch (equivalent to JDK 6u101), 64bit

SUN147692-85 Solaris 10 SPARC: JavaSE 7: update 85 patch (equivalent to JDK 7u85)

SUN147693-85 Solaris 10 SPARC: JavaSE 7: update 85 patch (equivalent to JDK 7u85), 64bit

SUN147694-85 Solaris 10 x86: JavaSE 7: update 85 patch (equivalent to JDK 7u85)

SUN147695-85 Solaris 10 x86: JavaSE 7: update 85 patch (equivalent to JDK 7u85), 64bit

SUN151009-51 Solaris 10 SPARC: JavaSE 8: update 51 patch (equivalent to JDK 8u51), 64bit

SUN151010-51 Solaris 10 x86: JavaSE 8: update 51 patch (equivalent to JDK 8u51), 64bit

Oracle Java SE Runtime Environment (JRE) 8 Update 51 for Mac OS X

Red Hat 2015:1526-01 RHSA Important: java-1.6.0-openjdk security update for RHEL 5 x86

Red Hat 2015:1526-01 RHSA Important: java-1.6.0-openjdk security update for RHEL 5 x86_64

Novell SUSE 2015:10761 java-1_6_0-ibm security update for SLES 11 SP3 i586

Novell SUSE 2015:10761 java-1_6_0-ibm security update for SLES 11 SP3 x86_64

Novell SUSE 2015:10784 java-1_7_0-ibm security update for SLES 11 SP3 i586

Novell SUSE 2015:10784 java-1_7_0-ibm security update for SLES 11 SP3 x86_64

Novell SUSE 2015:12012 java-1_7_0-openjdk security update for SLED 11 i586

Novell SUSE 2015:12012 java-1_7_0-openjdk security update for SLED 11 x86_64

Novell SUSE 2015:12026 java-1_7_0-ibm security update for SLES 11 SP3 i586

Novell SUSE 2015:12026 java-1_7_0-ibm security update for SLES 11 SP3 x86_64

Novell SUSE 2015:12072 java-1_6_0-ibm security update for SLES 11 SP3 i586

Novell SUSE 2015:12072 java-1_6_0-ibm security update for SLES 11 SP3 x86_64

Novell SUSE 2015:1538 java-1_6_0-ibm security update for SLES 11 SP3 i586

Novell SUSE 2015:1538 java-1_6_0-ibm security update for SLES 11 SP3 x86_64


Last Updated: 27 May 2016 11:09:32