CVE-2015-2808 The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to condu...
MediumCVSS 5.0
EPSS 73.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle communications application session controller | >= 3.0.0, <= 3.9.0 | No fix listed |
| oracle communications policy management | < 9.9.2 | 9.9.2 |
| oracle http server | = 11.1.1.7.0 | No fix listed |
| oracle http server | = 11.1.1.9.0 | No fix listed |
| oracle http server | = 12.1.3.0.0 | No fix listed |
| oracle http server | = 12.2.1.1.0 | No fix listed |
| oracle http server | = 12.2.1.2.0 | No fix listed |
| oracle integrated lights out manager firmware | >= 3.0.0, <= 3.2.11 | No fix listed |
| oracle integrated lights out manager firmware | >= 4.0.0, <= 4.0.4 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| redhat satellite | = 5.7 | No fix listed |
| redhat satellite | = 5.6 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 6.6 | No fix listed |
| redhat enterprise linux eus | = 7.1 | No fix listed |
| redhat enterprise linux eus | = 7.2 | No fix listed |
| redhat enterprise linux eus | = 7.3 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux eus | = 7.6 | No fix listed |
| redhat enterprise linux eus | = 7.7 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
Show 81 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 6.6 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp3 | No fix listed |
| SUSE linux enterprise debuginfo | = 11-sp4 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp4 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise server | = 10-sp4 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp3 | No fix listed |
| SUSE linux enterprise software development kit | = 12 | No fix listed |
| SUSE manager | = 1.7 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 15.04 | No fix listed |
| fujitsu sparc enterprise m3000 firmware | >= xcp, < xcp_1121 | xcp_1121 |
| fujitsu sparc enterprise m4000 firmware | >= xcp, < xcp_1121 | xcp_1121 |
| fujitsu sparc enterprise m5000 firmware | >= xcp, < xcp_1121 | xcp_1121 |
| fujitsu sparc enterprise m8000 firmware | >= xcp, < xcp_1121 | xcp_1121 |
| fujitsu sparc enterprise m9000 firmware | >= xcp, < xcp_1121 | xcp_1121 |
| Huawei e6000 firmware | All versions | No fix listed |
| Huawei e9000 firmware | All versions | No fix listed |
| Huawei oceanstor 18500 firmware | All versions | No fix listed |
| Huawei oceanstor 18800 firmware | All versions | No fix listed |
| Huawei oceanstor 18800f firmware | All versions | No fix listed |
| Huawei oceanstor 9000 firmware | All versions | No fix listed |
| Huawei oceanstor cse firmware | All versions | No fix listed |
| Huawei oceanstor hvs85t firmware | All versions | No fix listed |
| Huawei oceanstor s2600t firmware | All versions | No fix listed |
| Huawei oceanstor s5500t firmware | All versions | No fix listed |
| Huawei oceanstor s5600t firmware | All versions | No fix listed |
| Huawei oceanstor s5800t firmware | All versions | No fix listed |
| Huawei oceanstor s6800t firmware | All versions | No fix listed |
| Huawei oceanstor vis6600t firmware | All versions | No fix listed |
| Huawei quidway s9300 firmware | All versions | No fix listed |
| Huawei s7700 firmware | All versions | No fix listed |
| Huawei 9700 firmware | All versions | No fix listed |
| Huawei s12700 firmware | All versions | No fix listed |
| Huawei s2700 firmware | All versions | No fix listed |
| Huawei s3700 firmware | All versions | No fix listed |
| Huawei s5700ei firmware | All versions | No fix listed |
| Huawei s5700hi firmware | All versions | No fix listed |
| Huawei s5700si firmware | All versions | No fix listed |
| Huawei s5710ei firmware | All versions | No fix listed |
| Huawei s5710hi firmware | All versions | No fix listed |
| Huawei s6700 firmware | All versions | No fix listed |
| Huawei s2750 firmware | All versions | No fix listed |
| Huawei s5700li firmware | All versions | No fix listed |
| Huawei s5700s-li firmware | All versions | No fix listed |
| Huawei s5720hi firmware | All versions | No fix listed |
| Huawei s5720ei firmware | All versions | No fix listed |
| Huawei te60 firmware | All versions | No fix listed |
| Huawei oceanstor replicationdirector | = v100r003c00 | No fix listed |
| Huawei policy center | = v100r003c00 | No fix listed |
| Huawei policy center | = v100r003c10 | No fix listed |
| Huawei smc2.0 | = v100r002c01 | No fix listed |
| Huawei smc2.0 | = v100r002c02 | No fix listed |
| Huawei smc2.0 | = v100r002c03 | No fix listed |
| Huawei smc2.0 | = v100r002c04 | No fix listed |
| Huawei ultravr | = v100r003c00 | No fix listed |
| ibm cognos metrics manager | = 10.1 | No fix listed |
| ibm cognos metrics manager | = 10.1.1 | No fix listed |
| ibm cognos metrics manager | = 10.2 | No fix listed |
| ibm cognos metrics manager | = 10.2.1 | No fix listed |
| ibm cognos metrics manager | = 10.2.2 | No fix listed |
References
- h20564.www2.hpe.com third-party-advisory
- kb.juniper.net third-party-advisory
- kb.juniper.net third-party-advisory
- SUSE-SU-2015:1073 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1085 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1086 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1138 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1161 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:1288 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:1289 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1319 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1320 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:2166 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:2192 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0113 mailing-list third-party-advisory vendor-advisory
- HPSBGN03338 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03354 issue-tracking third-party-advisory vendor-advisory
- HPSBMU03377 issue-tracking third-party-advisory vendor-advisory
- SSRT102133 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03367 issue-tracking third-party-advisory vendor-advisory
- SSRT102127 issue-tracking third-party-advisory vendor-advisory
- HPSBMU03345 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03414 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03415 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03399 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03405 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03402 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03407 issue-tracking third-party-advisory vendor-advisory
- HPSBMU03401 issue-tracking third-party-advisory vendor-advisory
- HPSBGN03403 issue-tracking third-party-advisory vendor-advisory
- HPSBUX03512 issue-tracking third-party-advisory vendor-advisory
- RHSA-2015:1006 third-party-advisory vendor-advisory
- RHSA-2015:1007 third-party-advisory vendor-advisory
- RHSA-2015:1020 third-party-advisory vendor-advisory
- RHSA-2015:1021 third-party-advisory vendor-advisory
- RHSA-2015:1091 third-party-advisory vendor-advisory
- RHSA-2015:1228 third-party-advisory vendor-advisory
- RHSA-2015:1229 third-party-advisory vendor-advisory
- RHSA-2015:1230 third-party-advisory vendor-advisory
- RHSA-2015:1241 third-party-advisory vendor-advisory
- RHSA-2015:1242 third-party-advisory vendor-advisory
- RHSA-2015:1243 third-party-advisory vendor-advisory
- RHSA-2015:1526 third-party-advisory vendor-advisory
- IV71888 third-party-advisory vendor-advisory
- IV71892 third-party-advisory vendor-advisory
- www-01.ibm.com third-party-advisory
- www-304.ibm.com third-party-advisory
- www-304.ibm.com third-party-advisory
- www-304.ibm.com third-party-advisory
- DSA-3316 third-party-advisory vendor-advisory
- DSA-3339 third-party-advisory vendor-advisory
- www.huawei.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 73684 third-party-advisory vdb-entry
- 91787 third-party-advisory vdb-entry
- 1032599 third-party-advisory vdb-entry
- 1032600 third-party-advisory vdb-entry
- 1032707 third-party-advisory vdb-entry
- 1032708 third-party-advisory vdb-entry
- 1032734 third-party-advisory vdb-entry
- 1032788 third-party-advisory vdb-entry
- 1032858 third-party-advisory vdb-entry
- 1032868 third-party-advisory vdb-entry
- 1032910 third-party-advisory vdb-entry
- 1032990 third-party-advisory vdb-entry
- 1033071 third-party-advisory vdb-entry
- 1033072 third-party-advisory vdb-entry
- 1033386 third-party-advisory vdb-entry
- 1033415 third-party-advisory vdb-entry
- 1033431 third-party-advisory vdb-entry
- 1033432 third-party-advisory vdb-entry
- 1033737 third-party-advisory vdb-entry
- 1033769 third-party-advisory vdb-entry
- 1036222 third-party-advisory vdb-entry
- USN-2696-1 third-party-advisory vendor-advisory
- USN-2706-1 third-party-advisory vendor-advisory
- www1.huawei.com third-party-advisory
- SSRT102073 third-party-advisory vendor-advisory
- h20564.www2.hpe.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- h20564.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- h20566.www2.hpe.com third-party-advisory
- kb.juniper.net third-party-advisory
- kc.mcafee.com broken-link
- GLSA-201512-10 third-party-advisory vendor-advisory
- www-947.ibm.com third-party-advisory
- www.blackhat.com technical-description third-party-advisory