VulnerabilityModified

CVE-2015-2808

LOW 3.7EPSS 73.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 73.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

CVSS 3.1: 3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS: 73.85% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-327
Affected: oracle/communications application session controller · oracle/communications policy management · oracle/http server · oracle/integrated lights out manager firmware · debian/debian linux · redhat/satellite · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server tus · redhat/enterprise linux workstation · suse/linux enterprise debuginfo · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server · suse/linux enterprise software development kit · suse/manager · canonical/ubuntu linux · fujitsu/sparc enterprise m3000 firmware · +40 more
Source: cve@mitre.org

References

http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=143456209711959&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143629696317098&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143741441012338&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143817021313142&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143817899717054&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143818140118771&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144043644216842&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144059660127919&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144059703728085&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144060576831314&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144060606031437&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144069189622016&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144102017024820&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144104533800819&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144104565600964&w=2Issue Tracking, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.