What’s Vulnerable › Vulnerabilities
CVE-2015-2808
- Severity: medium (CVSS 5.0 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 73.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2015-04-01 · updated 2026-06-17
- Weakness: CWE-327
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 15.04
- Debian Linux: 7.0, 8.0
- Fujitsu Sparc Enterprise M3000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
- Fujitsu Sparc Enterprise M4000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
- Fujitsu Sparc Enterprise M5000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
- Fujitsu Sparc Enterprise M8000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
- Fujitsu Sparc Enterprise M9000 Firmware: from xcp before xcp_1121 — fixed in xcp_1121
- Huawei 9700 Firmware: all versions
- Huawei E6000 Firmware: all versions
- Huawei E9000 Firmware: all versions
- Huawei Oceanstor 18500 Firmware: all versions
- Huawei Oceanstor 18800 Firmware: all versions
- Huawei Oceanstor 18800F Firmware: all versions
- Huawei Oceanstor 9000 Firmware: all versions
- Huawei Oceanstor Cse Firmware: all versions
- Huawei Oceanstor Hvs85T Firmware: all versions
- Huawei Oceanstor Replicationdirector: v100r003c00
- Huawei Oceanstor S2600T Firmware: all versions
- Huawei Oceanstor S5500T Firmware: all versions
- Huawei Oceanstor S5600T Firmware: all versions
- Huawei Oceanstor S5800T Firmware: all versions
- Huawei Oceanstor S6800T Firmware: all versions
- Huawei Oceanstor Vis6600T Firmware: all versions
- Huawei Policy Center: v100r003c00, v100r003c10
- Huawei Quidway S9300 Firmware: all versions
- Huawei S12700 Firmware: all versions
- Huawei S2700 Firmware: all versions
- Huawei S2750 Firmware: all versions
- Huawei S3700 Firmware: all versions
- Huawei S5700Ei Firmware: all versions
How to fix
Upgrade to a fixed version: Fujitsu Sparc Enterprise M3000 Firmware xcp_1121; Fujitsu Sparc Enterprise M4000 Firmware xcp_1121; Fujitsu Sparc Enterprise M5000 Firmware xcp_1121; Fujitsu Sparc Enterprise M8000 Firmware xcp_1121; Fujitsu Sparc Enterprise M9000 Firmware xcp_1121; Oracle Corporation Communications Policy Management 9.9.2. Check the vendor advisory for mitigations.
References
- http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.html
Get alerted when CVE-2015-2808 or the next vulnerability affects your stack