CVE-2015-3197
OpenSSL: SSLv2 doesn't block disabled ciphers
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
ssl/s2_srvr.c en OpenSSL 1.0.1 en versiones anteriores a 1.0.1r y 1.0.2 en versiones anteriores a 1.0.2f no impide el uso de cifrados deshabilitados, lo que hace que sea más fácil para atacantes man-in-the-middle vencer los mecanismos de protección criptográfica llevando a cabo cálculos sobre tráfico SSLv2, relacionado con las funciones get_client_master_key y get_client_hello.
A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-04-10 CVE Reserved
- 2016-01-28 CVE Published
- 2024-08-06 CVE Updated
- 2024-10-22 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-310: Cryptographic Issues
CAPEC
References (38)
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Oracle Search vendor "Oracle" | Tuxedo Search vendor "Oracle" for product "Tuxedo" | 12.1.1.0 Search vendor "Oracle" for product "Tuxedo" and version "12.1.1.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Exalogic Infrastructure Search vendor "Oracle" for product "Exalogic Infrastructure" | 1.0 Search vendor "Oracle" for product "Exalogic Infrastructure" and version "1.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Exalogic Infrastructure Search vendor "Oracle" for product "Exalogic Infrastructure" | 2.0 Search vendor "Oracle" for product "Exalogic Infrastructure" and version "2.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" | 8.53 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.53" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" | 8.54 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.54" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" | 8.55 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.55" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1" | beta1 |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1" | beta2 |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1 Search vendor "Openssl" for product "Openssl" and version "1.0.1" | beta3 |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1a Search vendor "Openssl" for product "Openssl" and version "1.0.1a" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1b Search vendor "Openssl" for product "Openssl" and version "1.0.1b" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1c Search vendor "Openssl" for product "Openssl" and version "1.0.1c" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1d Search vendor "Openssl" for product "Openssl" and version "1.0.1d" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1e Search vendor "Openssl" for product "Openssl" and version "1.0.1e" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1f Search vendor "Openssl" for product "Openssl" and version "1.0.1f" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1g Search vendor "Openssl" for product "Openssl" and version "1.0.1g" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1h Search vendor "Openssl" for product "Openssl" and version "1.0.1h" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1i Search vendor "Openssl" for product "Openssl" and version "1.0.1i" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1j Search vendor "Openssl" for product "Openssl" and version "1.0.1j" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1k Search vendor "Openssl" for product "Openssl" and version "1.0.1k" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1l Search vendor "Openssl" for product "Openssl" and version "1.0.1l" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1m Search vendor "Openssl" for product "Openssl" and version "1.0.1m" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1n Search vendor "Openssl" for product "Openssl" and version "1.0.1n" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1o Search vendor "Openssl" for product "Openssl" and version "1.0.1o" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1p Search vendor "Openssl" for product "Openssl" and version "1.0.1p" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.1q Search vendor "Openssl" for product "Openssl" and version "1.0.1q" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | beta1 |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | beta2 |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2 Search vendor "Openssl" for product "Openssl" and version "1.0.2" | beta3 |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2a Search vendor "Openssl" for product "Openssl" and version "1.0.2a" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2b Search vendor "Openssl" for product "Openssl" and version "1.0.2b" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2c Search vendor "Openssl" for product "Openssl" and version "1.0.2c" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2d Search vendor "Openssl" for product "Openssl" and version "1.0.2d" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | 1.0.2e Search vendor "Openssl" for product "Openssl" and version "1.0.2e" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Oss Support Tools Search vendor "Oracle" for product "Oss Support Tools" | 8.11.16.3.8 Search vendor "Oracle" for product "Oss Support Tools" and version "8.11.16.3.8" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Vm Virtualbox Search vendor "Oracle" for product "Vm Virtualbox" | 5.0.16 Search vendor "Oracle" for product "Vm Virtualbox" and version "5.0.16" | - |
Affected
|