CVE-2015-2808

low · 3.7

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

3.7

CVSS

73.9%

EPSS (exploit prob.)

99th

EPSS percentile

2015-04-01

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-327

Affected products

Vendor	Product	Affected versions
oracle	communications_application_session_controller	>= 3.0.0, <= 3.9.0
oracle	communications_policy_management	< 9.9.2
oracle	http_server	11.1.1.7.0
oracle	http_server	11.1.1.9.0
oracle	http_server	12.1.3.0.0
oracle	http_server	12.2.1.1.0
oracle	http_server	12.2.1.2.0
oracle	integrated_lights_out_manager_firmware	>= 3.0.0, <= 3.2.11
oracle	integrated_lights_out_manager_firmware	>= 4.0.0, <= 4.0.4
debian	debian_linux	7.0
debian	debian_linux	8.0
redhat	satellite	5.7
redhat	enterprise_linux_desktop	5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_desktop	7.0
redhat	enterprise_linux_eus	6.6
redhat	enterprise_linux_eus	7.1
redhat	enterprise_linux_eus	7.2
redhat	enterprise_linux_eus	7.3
redhat	enterprise_linux_eus	7.4
redhat	enterprise_linux_eus	7.5
redhat	enterprise_linux_eus	7.6
redhat	enterprise_linux_eus	7.7
redhat	enterprise_linux_server	5.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server	7.0
redhat	enterprise_linux_server_aus	6.6
redhat	enterprise_linux_server_aus	7.3
redhat	enterprise_linux_server_aus	7.4
redhat	enterprise_linux_server_aus	7.6
redhat	enterprise_linux_server_aus	7.7
redhat	enterprise_linux_server_tus	7.3
redhat	enterprise_linux_server_tus	7.6
redhat	enterprise_linux_server_tus	7.7
redhat	enterprise_linux_workstation	5.0
redhat	enterprise_linux_workstation	6.0
redhat	enterprise_linux_workstation	7.0
suse	linux_enterprise_debuginfo	11
suse	linux_enterprise_debuginfo	11
opensuse	opensuse	13.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-2808