CVE-2015-2808
Low
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
SeverityLow
CVSS3.7
Exploit probability—
Product
Oracle Communications Application Session Controller
PublishedApr 1, 2015
First seenApr 1, 2015
Weakness typeCWE-327CWE-327
How to fix
Update
- oracle communications_policy_management9.9.2 or later
- fujitsu sparc_enterprise_m3000_firmwarexcp_1121 or later
- fujitsu sparc_enterprise_m4000_firmwarexcp_1121 or later
- fujitsu sparc_enterprise_m5000_firmwarexcp_1121 or later
- fujitsu sparc_enterprise_m8000_firmwarexcp_1121 or later
- fujitsu sparc_enterprise_m9000_firmwarexcp_1121 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle communications_application_session_controller | 3.0.0 ≤ v ≤ 3.9.0 | — |
| oracle communications_policy_management | v < 9.9.2 | 9.9.2 |
| oracle http_server | 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0 | — |
| oracle integrated_lights_out_manager_firmware | 3.0.0 ≤ v ≤ 3.2.11, 4.0.0 ≤ v ≤ 4.0.4 | — |
| debian debian_linux | 7.0, 8.0 | — |
| redhat satellite | 5.7, 5.6 | — |
| redhat enterprise_linux_desktop | 5.0, 6.0, 7.0 | — |
| redhat enterprise_linux_eus | 6.6, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_server | 5.0, 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 6.6, 7.3, 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.3, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 5.0, 6.0, 7.0 | — |
| suse linux_enterprise_debuginfo | 11 | — |
| opensuse opensuse | 13.1, 13.2 | — |
| suse linux_enterprise_desktop | 11, 12 | — |
| suse linux_enterprise_server | 10, 11, 12 | — |
| suse linux_enterprise_software_development_kit | 11, 12 | — |
| suse manager | 1.7 | — |
| canonical ubuntu_linux | 12.04, 14.04, 15.04 | — |
| fujitsu sparc_enterprise_m3000_firmware | xcp ≤ v < xcp_1121 | xcp_1121 |
| fujitsu sparc_enterprise_m4000_firmware | xcp ≤ v < xcp_1121 | xcp_1121 |
| fujitsu sparc_enterprise_m5000_firmware | xcp ≤ v < xcp_1121 | xcp_1121 |
| fujitsu sparc_enterprise_m8000_firmware | xcp ≤ v < xcp_1121 | xcp_1121 |
| fujitsu sparc_enterprise_m9000_firmware | xcp ≤ v < xcp_1121 | xcp_1121 |
| huawei e6000_firmware | No range specified | — |
| huawei e9000_firmware | No range specified | — |
| huawei oceanstor_18500_firmware | No range specified | — |
| huawei oceanstor_18800_firmware | No range specified | — |
| huawei oceanstor_18800f_firmware | No range specified | — |
| huawei oceanstor_9000_firmware | No range specified | — |
| huawei oceanstor_cse_firmware | No range specified | — |
| huawei oceanstor_hvs85t_firmware | No range specified | — |
| huawei oceanstor_s2600t_firmware | No range specified | — |
| huawei oceanstor_s5500t_firmware | No range specified | — |
| huawei oceanstor_s5600t_firmware | No range specified | — |
| huawei oceanstor_s5800t_firmware | No range specified | — |
| huawei oceanstor_s6800t_firmware | No range specified | — |
| huawei oceanstor_vis6600t_firmware | No range specified | — |
| huawei quidway_s9300_firmware | No range specified | — |
| huawei s7700_firmware | No range specified | — |
| huawei 9700_firmware | No range specified | — |
| huawei s12700_firmware | No range specified | — |
| huawei s2700_firmware | No range specified | — |
| huawei s3700_firmware | No range specified | — |
| huawei s5700ei_firmware | No range specified | — |
| huawei s5700hi_firmware | No range specified | — |
| huawei s5700si_firmware | No range specified | — |
| huawei s5710ei_firmware | No range specified | — |
| huawei s5710hi_firmware | No range specified | — |
| huawei s6700_firmware | No range specified | — |
| huawei s2750_firmware | No range specified | — |
| huawei s5700li_firmware | No range specified | — |
| huawei s5700s-li_firmware | No range specified | — |
| huawei s5720hi_firmware | No range specified | — |
| huawei s5720ei_firmware | No range specified | — |
| huawei te60_firmware | No range specified | — |
| huawei oceanstor_replicationdirector | v100r003c00 | — |
| huawei policy_center | v100r003c00, v100r003c10 | — |
| huawei smc2.0 | v100r002c01, v100r002c02, v100r002c03, v100r002c04 | — |
| huawei ultravr | v100r003c00 | — |
| ibm cognos_metrics_manager | 10.1, 10.1.1, 10.2, 10.2.1, 10.2.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.