Lucene search
HistoryMar 25, 2015 - 1:59 a.m.
CVE-2015-0138
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
AI Score
Confidence
Low
0.948 High
EPSS
Percentile
99.3%
GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the “FREAK” issue, a different vulnerability than CVE-2015-0204.
Affected configurations
Node
ibmtivoli_directory_serverRange≤6.0.0.73
ORibmtivoli_directory_serverMatch6.1.0
ORibmtivoli_directory_serverMatch6.1.0.0
ORibmtivoli_directory_serverMatch6.1.0.1
ORibmtivoli_directory_serverMatch6.1.0.2
ORibmtivoli_directory_serverMatch6.1.0.3
ORibmtivoli_directory_serverMatch6.1.0.4
ORibmtivoli_directory_serverMatch6.1.0.5
ORibmtivoli_directory_serverMatch6.1.0.6
ORibmtivoli_directory_serverMatch6.1.0.7
ORibmtivoli_directory_serverMatch6.1.0.8
ORibmtivoli_directory_serverMatch6.1.0.9
ORibmtivoli_directory_serverMatch6.1.0.10
ORibmtivoli_directory_serverMatch6.1.0.11
ORibmtivoli_directory_serverMatch6.1.0.12
ORibmtivoli_directory_serverMatch6.1.0.13
ORibmtivoli_directory_serverMatch6.1.0.14
ORibmtivoli_directory_serverMatch6.1.0.15
ORibmtivoli_directory_serverMatch6.1.0.17
ORibmtivoli_directory_serverMatch6.1.0.18
ORibmtivoli_directory_serverMatch6.1.0.19
ORibmtivoli_directory_serverMatch6.1.0.20
ORibmtivoli_directory_serverMatch6.1.0.21
ORibmtivoli_directory_serverMatch6.1.0.22
ORibmtivoli_directory_serverMatch6.1.0.23
ORibmtivoli_directory_serverMatch6.1.0.24
ORibmtivoli_directory_serverMatch6.1.0.25
ORibmtivoli_directory_serverMatch6.1.0.26
ORibmtivoli_directory_serverMatch6.1.0.27
ORibmtivoli_directory_serverMatch6.1.0.28
ORibmtivoli_directory_serverMatch6.1.0.29
ORibmtivoli_directory_serverMatch6.1.0.30
ORibmtivoli_directory_serverMatch6.1.0.31
ORibmtivoli_directory_serverMatch6.1.0.32
ORibmtivoli_directory_serverMatch6.1.0.33
ORibmtivoli_directory_serverMatch6.1.0.34
ORibmtivoli_directory_serverMatch6.1.0.35
ORibmtivoli_directory_serverMatch6.1.0.36
ORibmtivoli_directory_serverMatch6.1.0.37
ORibmtivoli_directory_serverMatch6.1.0.38
ORibmtivoli_directory_serverMatch6.1.0.39
ORibmtivoli_directory_serverMatch6.1.0.40
ORibmtivoli_directory_serverMatch6.1.0.41
ORibmtivoli_directory_serverMatch6.1.0.42
ORibmtivoli_directory_serverMatch6.1.0.43
ORibmtivoli_directory_serverMatch6.1.0.44
ORibmtivoli_directory_serverMatch6.1.0.45
ORibmtivoli_directory_serverMatch6.1.0.46
ORibmtivoli_directory_serverMatch6.1.0.47
ORibmtivoli_directory_serverMatch6.1.0.48
ORibmtivoli_directory_serverMatch6.1.0.49
ORibmtivoli_directory_serverMatch6.1.0.50
ORibmtivoli_directory_serverMatch6.1.0.51
ORibmtivoli_directory_serverMatch6.1.0.52
ORibmtivoli_directory_serverMatch6.1.0.53
ORibmtivoli_directory_serverMatch6.1.0.54
ORibmtivoli_directory_serverMatch6.1.0.55
ORibmtivoli_directory_serverMatch6.1.0.56
ORibmtivoli_directory_serverMatch6.1.0.57
ORibmtivoli_directory_serverMatch6.1.0.58
ORibmtivoli_directory_serverMatch6.1.0.59
ORibmtivoli_directory_serverMatch6.1.0.60
ORibmtivoli_directory_serverMatch6.1.0.61
ORibmtivoli_directory_serverMatch6.1.0.62
ORibmtivoli_directory_serverMatch6.1.0.63
ORibmtivoli_directory_serverMatch6.1.0.64
ORibmtivoli_directory_serverMatch6.1.0.65
ORibmtivoli_directory_serverMatch6.1.0.66
ORibmtivoli_directory_serverMatch6.2.0.0
ORibmtivoli_directory_serverMatch6.2.0.1
ORibmtivoli_directory_serverMatch6.2.0.2
ORibmtivoli_directory_serverMatch6.2.0.3
ORibmtivoli_directory_serverMatch6.2.0.4
ORibmtivoli_directory_serverMatch6.2.0.5
ORibmtivoli_directory_serverMatch6.2.0.6
ORibmtivoli_directory_serverMatch6.2.0.7
ORibmtivoli_directory_serverMatch6.2.0.8
ORibmtivoli_directory_serverMatch6.2.0.10
ORibmtivoli_directory_serverMatch6.2.0.11
ORibmtivoli_directory_serverMatch6.2.0.12
ORibmtivoli_directory_serverMatch6.2.0.13
ORibmtivoli_directory_serverMatch6.2.0.14
ORibmtivoli_directory_serverMatch6.2.0.15
ORibmtivoli_directory_serverMatch6.2.0.19
ORibmtivoli_directory_serverMatch6.2.0.20
ORibmtivoli_directory_serverMatch6.2.0.21
ORibmtivoli_directory_serverMatch6.2.0.22
ORibmtivoli_directory_serverMatch6.2.0.23
ORibmtivoli_directory_serverMatch6.2.0.24
ORibmtivoli_directory_serverMatch6.2.0.25
ORibmtivoli_directory_serverMatch6.2.0.26
ORibmtivoli_directory_serverMatch6.2.0.27
ORibmtivoli_directory_serverMatch6.2.0.29
ORibmtivoli_directory_serverMatch6.2.0.30
ORibmtivoli_directory_serverMatch6.2.0.31
ORibmtivoli_directory_serverMatch6.2.0.32
ORibmtivoli_directory_serverMatch6.2.0.33
ORibmtivoli_directory_serverMatch6.2.0.34
ORibmtivoli_directory_serverMatch6.2.0.35
ORibmtivoli_directory_serverMatch6.2.0.36
ORibmtivoli_directory_serverMatch6.2.0.37
ORibmtivoli_directory_serverMatch6.2.0.38
ORibmtivoli_directory_serverMatch6.2.0.39
ORibmtivoli_directory_serverMatch6.2.0.40
ORibmtivoli_directory_serverMatch6.2.0.41
ORibmtivoli_directory_serverMatch6.2.0.42
ORibmtivoli_directory_serverMatch6.3.0.0
ORibmtivoli_directory_serverMatch6.3.0.1
ORibmtivoli_directory_serverMatch6.3.0.2
ORibmtivoli_directory_serverMatch6.3.0.8
ORibmtivoli_directory_serverMatch6.3.0.9
ORibmtivoli_directory_serverMatch6.3.0.10
ORibmtivoli_directory_serverMatch6.3.0.11
ORibmtivoli_directory_serverMatch6.3.0.12
ORibmtivoli_directory_serverMatch6.3.0.14
ORibmtivoli_directory_serverMatch6.3.0.15
ORibmtivoli_directory_serverMatch6.3.0.17
ORibmtivoli_directory_serverMatch6.3.0.18
ORibmtivoli_directory_serverMatch6.3.0.19
ORibmtivoli_directory_serverMatch6.3.0.21
ORibmtivoli_directory_serverMatch6.3.0.22
ORibmtivoli_directory_serverMatch6.3.0.23
ORibmtivoli_directory_serverMatch6.3.0.24
ORibmtivoli_directory_serverMatch6.3.0.25
ORibmtivoli_directory_serverMatch6.3.0.26
ORibmtivoli_directory_serverMatch6.3.0.27
ORibmtivoli_directory_serverMatch6.3.0.28
ORibmtivoli_directory_serverMatch6.3.0.29
ORibmtivoli_directory_serverMatch6.3.0.30
ORibmtivoli_directory_serverMatch6.3.0.31
ORibmtivoli_directory_serverMatch6.3.0.32
ORibmtivoli_directory_serverMatch6.3.0.33
ORibmtivoli_directory_serverMatch6.3.0.34
ORibmtivoli_directory_serverMatch6.3.0.35
ORibmtivoli_directory_serverMatch6.3.1.0
ORibmtivoli_directory_serverMatch6.3.1.5
ORibmtivoli_directory_serverMatch6.3.1.6
ORibmtivoli_directory_serverMatch6.3.1.7
ORibmtivoli_directory_serverMatch6.3.1.8
ORibmtivoli_directory_serverMatch6.3.1.9
References
lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html
rhn.redhat.com/errata/RHSA-2015-1006.html
rhn.redhat.com/errata/RHSA-2015-1007.html
rhn.redhat.com/errata/RHSA-2015-1020.html
rhn.redhat.com/errata/RHSA-2015-1021.html
rhn.redhat.com/errata/RHSA-2015-1091.html
www-01.ibm.com/support/docview.wss?uid=swg21698703
www-01.ibm.com/support/docview.wss?uid=swg21883640
www.securityfocus.com/bid/73326
Related
prion
prion
Design/Logic Flaw
2015-03-25 01:59:00
Code injection
2015-01-09 02:59:00
Design/Logic Flaw
2015-08-20 10:59:00
cvelist
cvelist
cve
cve
nessus
nessus
ibm
ibm
aix
aix
AIX IBM SDK Java JSSE vulnerability
2015-04-13 12:11:24
cisa
cisa
FREAK
2015-03-06 00:00:00
cisco
cisco
OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability
2015-01-13 19:57:19
f5
f5
K16139 : OpenSSL vulnerability CVE-2015-0204
2015-10-02 00:00:00
SOL16139 - OpenSSL vulnerability CVE-2015-0204
2015-02-12 00:00:00
K16903 : Microsoft Schannel vulnerability CVE-2015-1637
2015-07-13 00:00:00
hackerone
hackerone
openvas
openvas
DTLS: Deprecated DTLSv1.0 Detection
2024-01-09 00:00:00
SSL/TLS: RSA Temporary Key Handling 'RSA_EXPORT' Downgrade Issue (FREAK)
2015-03-06 00:00:00
OpenSSL Information Disclosure Vulnerability (20150319 - 4) - Linux
2021-07-29 00:00:00
debiancve
debiancve
CVE-2015-0204
2015-01-09 02:59:10
CVE-2015-2319
2018-01-08 19:29:00
openssl
openssl
Vulnerability in OpenSSL CVE-2015-0204
2015-01-06 00:00:00
fortinet
fortinet
TLS FREAK Attack
2015-03-04 00:00:00
veracode
veracode
Brute Force Decryption
2017-02-10 01:27:34
nvd
nvd
ubuntucve
ubuntucve
CVE-2015-0204
2015-01-08 00:00:00
CVE-2015-2319
2015-03-18 00:00:00
thn
thn
'FREAK' — New SSL/TLS Vulnerability Explained
2015-03-03 20:30:00
OpenSSL to Patch Undisclosed High Severity Vulnerability this Thursday
2015-07-06 22:12:00
checkpoint_security
checkpoint_security
Check Point response to TLS FREAK Attack (CVE-2015-0204)
2015-03-03 22:00:00
cert
cert
SSL/TLS implementations accept export-grade RSA keys (FREAK attack)
2015-03-06 00:00:00
checkpoint_advisories
checkpoint_advisories
SSL Export Cipher Suite (CVE-2015-0204; CVE-2015-1637)
2015-03-04 00:00:00
OpenSSL TLS Export Cipher Suite Downgrade (CVE-2015-0204; CVE-2015-1637)
2015-03-04 00:00:00
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6.1 Medium
AI Score
Confidence
Low
0.948 High
EPSS
Percentile
99.3%
Related for NVD:CVE-2015-0138