What’s Vulnerable › Vulnerabilities

CVE-2013-2566

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 84.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-03-15 · updated 2026-06-16
• Weakness: CWE-326

Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.

Affected products

• Canonical Ubuntu Linux: 12.04, 12.10, 13.04, 13.10
• Fujitsu M10-1 Firmware: from xcp before xcp2280 — fixed in xcp2280
• Fujitsu M10-4 Firmware: from xcp before xcp2280 — fixed in xcp2280
• Fujitsu M10-4S Firmware: from xcp before xcp2280 — fixed in xcp2280
• Fujitsu Sparc Enterprise M3000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
• Fujitsu Sparc Enterprise M4000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
• Fujitsu Sparc Enterprise M5000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
• Fujitsu Sparc Enterprise M8000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
• Fujitsu Sparc Enterprise M9000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
• Mozilla Firefox: before 17.0.11; before 25.0.1; from 24.1.0 before 24.1.1 — fixed in 17.0.11, 24.1.1, 25.0.1
• Mozilla Seamonkey: before 2.22.1 — fixed in 2.22.1
• Mozilla Thunderbird: before 24.1.1 — fixed in 24.1.1
• Mozilla Thunderbird ESR: before 17.0.11 — fixed in 17.0.11
• Oracle Communications Application Session Controller: from 3.0.0 through 3.9.1
• Oracle Corporation Oracle HTTP Server: 11.1.1.7.0, 11.1.1.9.0, 12.1.3.0.0, 12.2.1.1.0, 12.2.1.2.0
• Oracle Corporation SSM - (hot-tamale) ILOM: Integrated Lights Out Manager: from 3.0.0 through 3.2.11; from 4.0.0 through 4.0.4

How to fix

Upgrade to a fixed version: Fujitsu M10-1 Firmware xcp2280; Fujitsu M10-4 Firmware xcp2280; Fujitsu M10-4S Firmware xcp2280; Fujitsu Sparc Enterprise M3000 Firmware xcp_1121; Fujitsu Sparc Enterprise M4000 Firmware xcp_1121; Fujitsu Sparc Enterprise M5000 Firmware xcp_1121; Fujitsu Sparc Enterprise M8000 Firmware xcp_1121; Fujitsu Sparc Enterprise M9000 Firmware xcp_1121; Mozilla Firefox 17.0.11, 24.1.1, 25.0.1; Mozilla Seamonkey 2.22.1; Mozilla Thunderbird 24.1.1; Mozilla Thunderbird ESR 17.0.11. Check the vendor advisory for mitigations.

References

• http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html
• http://cr.yp.to/talks/2013.03.12/slides.pdf
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
• http://marc.info/?l=bugtraq&m=143039468003789&w=2
• http://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4
• http://security.gentoo.org/glsa/glsa-201406-19.xml
• http://www.isg.rhul.ac.uk/tls/
• http://www.mozilla.org/security/announce/2013/mfsa2013-103.html
• http://www.opera.com/docs/changelogs/unified/1215/
• http://www.opera.com/security/advisory/1046
• http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
• http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Get alerted when CVE-2013-2566 or the next vulnerability affects your stack