CVE-2015-2808

EPSS 73.85%
Veröffentlicht 01.04.2015 02:00:35
Zuletzt bearbeitet 28.05.2026 14:16:16
Erkennungen
Login

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 104

NVD 113 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Oracle ≫ Communications Application Session Controller Version >= 3.0.0 <= 3.9.0

Oracle ≫ Communications Policy Management Version < 9.9.2

Oracle ≫ HTTP Server Version 11.1.1.7.0

Oracle ≫ HTTP Server Version 11.1.1.9.0

Oracle ≫ HTTP Server Version 12.1.3.0.0

Oracle ≫ HTTP Server Version 12.2.1.1.0

Oracle ≫ HTTP Server Version 12.2.1.2.0

Oracle ≫ Integrated Lights Out Manager Firmware Version >= 3.0.0 <= 3.2.11

Oracle ≫ Integrated Lights Out Manager Firmware Version >= 4.0.0 <= 4.0.4

Debian ≫ Debian Linux Version 7.0

Debian ≫ Debian Linux Version 8.0

Redhat ≫ Satellite Version 5.7

Redhat ≫ Enterprise Linux Desktop Version 5.0

Redhat ≫ Enterprise Linux Desktop Version 6.0

Redhat ≫ Enterprise Linux Desktop Version 7.0

Redhat ≫ Enterprise Linux Eus Version 6.6

Redhat ≫ Enterprise Linux Eus Version 7.1

Redhat ≫ Enterprise Linux Eus Version 7.2

Redhat ≫ Enterprise Linux Eus Version 7.3

Redhat ≫ Enterprise Linux Eus Version 7.4

Redhat ≫ Enterprise Linux Eus Version 7.5

Redhat ≫ Enterprise Linux Eus Version 7.6

Redhat ≫ Enterprise Linux Eus Version 7.7

Redhat ≫ Enterprise Linux Server Version 5.0

Redhat ≫ Enterprise Linux Server Version 6.0

Redhat ≫ Enterprise Linux Server Version 7.0

Redhat ≫ Enterprise Linux Server Aus Version 6.6

Redhat ≫ Enterprise Linux Server Aus Version 7.3

Redhat ≫ Enterprise Linux Server Aus Version 7.4

Redhat ≫ Enterprise Linux Server Aus Version 7.6

Redhat ≫ Enterprise Linux Server Aus Version 7.7

Redhat ≫ Enterprise Linux Server Tus Version 7.3

Redhat ≫ Enterprise Linux Server Tus Version 7.6

Redhat ≫ Enterprise Linux Server Tus Version 7.7

Redhat ≫ Enterprise Linux Workstation Version 5.0

Redhat ≫ Enterprise Linux Workstation Version 6.0

Redhat ≫ Enterprise Linux Workstation Version 7.0

Suse ≫ Linux Enterprise Debuginfo Version 11 Update sp3

Suse ≫ Linux Enterprise Debuginfo Version 11 Update sp4

Opensuse ≫ Opensuse Version 13.1

Opensuse ≫ Opensuse Version 13.2

Suse ≫ Linux Enterprise Desktop Version 11 Update sp3

Suse ≫ Linux Enterprise Desktop Version 11 Update sp4

Suse ≫ Linux Enterprise Desktop Version 12 Update -

Suse ≫ Linux Enterprise Server Version 10 Update sp4 SwEdition ltss

Suse ≫ Linux Enterprise Server Version 11 Update sp1 SwEdition ltss

Suse ≫ Linux Enterprise Server Version 11 Update sp2 SwEdition ltss

Suse ≫ Linux Enterprise Server Version 11 Update sp3 SwPlatform vmware

Suse ≫ Linux Enterprise Server Version 12 Update -

Suse ≫ Linux Enterprise Software Development Kit Version 11 Update sp3

Suse ≫ Linux Enterprise Software Development Kit Version 12 Update -

Suse ≫ Manager Version 1.7

Suse ≫ Linux Enterprise Server Version 11 Update sp2 SwPlatform -

Canonical ≫ Ubuntu Linux Version 12.04 SwEdition esm

Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm

Canonical ≫ Ubuntu Linux Version 15.04

Redhat ≫ Satellite Version 5.6

Redhat ≫ Enterprise Linux Version 5.0
Redhat ≫ Enterprise Linux Version 6.0

Fujitsu ≫ Sparc Enterprise M3000 Firmware Version >= xcp < xcp_1121

Fujitsu ≫ Sparc Enterprise M3000 Version -

Fujitsu ≫ Sparc Enterprise M4000 Firmware Version >= xcp < xcp_1121

Fujitsu ≫ Sparc Enterprise M4000 Version -

Fujitsu ≫ Sparc Enterprise M5000 Firmware Version >= xcp < xcp_1121

Fujitsu ≫ Sparc Enterprise M5000 Version -

Fujitsu ≫ Sparc Enterprise M8000 Firmware Version >= xcp < xcp_1121

Fujitsu ≫ Sparc Enterprise M8000 Version -

Fujitsu ≫ Sparc Enterprise M9000 Firmware Version >= xcp < xcp_1121

Fujitsu ≫ Sparc Enterprise M9000 Version -

Huawei ≫ E6000 Firmware Version -

Huawei ≫ E6000 Version -

Huawei ≫ E9000 Firmware Version -

Huawei ≫ E9000 Version -

Huawei ≫ Oceanstor 18500 Firmware Version -

Huawei ≫ Oceanstor 18500 Version -

Huawei ≫ Oceanstor 18800 Firmware Version -

Huawei ≫ Oceanstor 18800 Version -

Huawei ≫ Oceanstor 18800f Firmware Version -

Huawei ≫ Oceanstor 18800f Version -

Huawei ≫ Oceanstor 9000 Firmware Version -

Huawei ≫ Oceanstor 9000 Version -

Huawei ≫ Oceanstor Cse Firmware Version -

Huawei ≫ Oceanstor Cse Version -

Huawei ≫ Oceanstor Hvs85t Firmware Version -

Huawei ≫ Oceanstor Hvs85t Version -

Huawei ≫ Oceanstor S2600t Firmware Version -

Huawei ≫ Oceanstor S2600t Version -

Huawei ≫ Oceanstor S5500t Firmware Version -

Huawei ≫ Oceanstor S5500t Version -

Huawei ≫ Oceanstor S5600t Firmware Version -

Huawei ≫ Oceanstor S5600t Version -

Huawei ≫ Oceanstor S5800t Firmware Version -

Huawei ≫ Oceanstor S5800t Version -

Huawei ≫ Oceanstor S6800t Firmware Version -

Huawei ≫ Oceanstor S6800t Version -

Huawei ≫ Oceanstor Vis6600t Firmware Version -

Huawei ≫ Oceanstor Vis6600t Version -

Huawei ≫ Quidway S9300 Firmware Version -

Huawei ≫ Quidway S9300 Version -

Huawei ≫ S7700 Firmware Version -

Huawei ≫ S7700 Version -

Huawei ≫ S7700 Firmware Version -

Huawei ≫ S7700 Version -

Huawei ≫ 9700 Firmware Version -

Huawei ≫ 9700 Version -

Huawei ≫ 9700 Firmware Version -

Huawei ≫ 9700 Version -

Huawei ≫ S12700 Firmware Version -

Huawei ≫ S12700 Version -

Huawei ≫ S12700 Firmware Version -

Huawei ≫ S12700 Version -

Huawei ≫ S2700 Firmware Version -

Huawei ≫ S2700 Version -

Huawei ≫ S3700 Firmware Version -

Huawei ≫ S3700 Version -

Huawei ≫ S5700ei Firmware Version -

Huawei ≫ S5700ei Version -

Huawei ≫ S5700hi Firmware Version -

Huawei ≫ S5700hi Version -

Huawei ≫ S5700si Firmware Version -

Huawei ≫ S5700si Version -

Huawei ≫ S5710ei Firmware Version -

Huawei ≫ S5710ei Version -

Huawei ≫ S5710hi Firmware Version -

Huawei ≫ S5710hi Version -

Huawei ≫ S6700 Firmware Version -

Huawei ≫ S6700 Version -

Huawei ≫ S2750 Firmware Version -

Huawei ≫ S2750 Version -

Huawei ≫ S5700li Firmware Version -

Huawei ≫ S5700li Version -

Huawei ≫ S5700s-li Firmware Version -

Huawei ≫ S5700s-li Version -

Huawei ≫ S5720hi Firmware Version -

Huawei ≫ S5720hi Version -

Huawei ≫ S2750 Firmware Version -

Huawei ≫ S2750 Version -

Huawei ≫ S5700li Firmware Version -

Huawei ≫ S5700li Version -

Huawei ≫ S5700s-li Firmware Version -

Huawei ≫ S5700s-li Version -

Huawei ≫ S5720hi Firmware Version -

Huawei ≫ S5720hi Version -

Huawei ≫ S5720ei Firmware Version -

Huawei ≫ S5720ei Version -

Huawei ≫ Te60 Firmware Version -

Huawei ≫ Te60 Version -

Huawei ≫ Oceanstor Replicationdirector Version v100r003c00

Huawei ≫ Policy Center Version v100r003c00

Huawei ≫ Policy Center Version v100r003c10

Huawei ≫ Smc2.0 Version v100r002c01

Huawei ≫ Smc2.0 Version v100r002c02

Huawei ≫ Smc2.0 Version v100r002c03

Huawei ≫ Smc2.0 Version v100r002c04

Huawei ≫ Ultravr Version v100r003c00

Ibm ≫ Cognos Metrics Manager Version 10.1

Ibm ≫ Cognos Metrics Manager Version 10.1.1

Ibm ≫ Cognos Metrics Manager Version 10.2

Ibm ≫ Cognos Metrics Manager Version 10.2.1

Ibm ≫ Cognos Metrics Manager Version 10.2.2

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	73.85%	0.994

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
CISA-ADP	3.7	2.2	1.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1006.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1007.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1020.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1021.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1091.html

Third Party Advisory

https://kc.mcafee.com/corporate/index?page=content&id=SB10163

Broken Link

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Patch

Third Party Advisory

https://kb.juniper.net/JSA10783

Third Party Advisory

http://marc.info/?l=bugtraq&m=144493176821532&w=2

Third Party Advisory

Issue Tracking

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246

Third Party Advisory

http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.html

Third Party Advisory

Mailing List

http://marc.info/?l=bugtraq&m=144043644216842&w=2

Third Party Advisory

Issue Tracking

http://www-01.ibm.com/support/docview.wss?uid=swg21883640

Third Party Advisory

http://www-304.ibm.com/support/docview.wss?uid=swg21960769

Third Party Advisory

http://www.securityfocus.com/bid/91787

Third Party Advisory

VDB Entry

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773241

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html

Third Party Advisory

Mailing List

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html

Third Party Advisory

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html

Third Party Advisory

Mailing List

http://marc.info/?l=bugtraq&m=143456209711959&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=143629696317098&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=143741441012338&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=143817021313142&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=143817899717054&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=143818140118771&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144059660127919&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144059703728085&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144060576831314&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144060606031437&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144069189622016&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144102017024820&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144104533800819&w=2

Third Party Advisory

Issue Tracking

http://marc.info/?l=bugtraq&m=144104565600964&w=2

Third Party Advisory

Issue Tracking

http://rhn.redhat.com/errata/RHSA-2015-1228.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1229.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1230.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1241.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1242.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1243.html

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1526.html

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888

Third Party Advisory

http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892

Third Party Advisory

http://www-304.ibm.com/support/docview.wss?uid=swg21903565

Third Party Advisory

http://www-304.ibm.com/support/docview.wss?uid=swg21960015

Third Party Advisory

http://www.debian.org/security/2015/dsa-3316

Third Party Advisory

http://www.debian.org/security/2015/dsa-3339

Third Party Advisory

http://www.huawei.com/en/psirt/security-advisories/hw-454055

Third Party Advisory

http://www.securityfocus.com/bid/73684

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032599

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032600

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032707

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032708

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032734

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032788

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032858

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032868

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032910

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1032990

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033071

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033072

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033386

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033415

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033431

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033432

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033737

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1033769

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1036222

Third Party Advisory

VDB Entry

http://www.ubuntu.com/usn/USN-2696-1

Third Party Advisory

http://www.ubuntu.com/usn/USN-2706-1

Third Party Advisory

http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-454055.htm

Third Party Advisory

https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04687922

Third Party Advisory

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04770140

Third Party Advisory

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04772190

Third Party Advisory

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773119

Third Party Advisory

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04773256

Third Party Advisory

https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04926789

Third Party Advisory

https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04708650

Third Party Advisory

https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04711380

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05085988

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05193347

Third Party Advisory

https://security.gentoo.org/glsa/201512-10

Third Party Advisory

https://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5098709

Third Party Advisory

https://www.blackhat.com/docs/asia-15/materials/asia-15-Mantin-Bar-Mitzvah-Attack-Breaking-SSL-With-13-Year-Old-RC4-Weakness-wp.pdf

Third Party Advisory

Technical Description

https://www.secpod.com/blog/cve-2015-2808-bar-mitzvah-attack-in-rc4-2/

https://nvd.nist.gov/vuln/detail/CVE-2015-2808

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-2808

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-2808

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2015-2808