Lucene search
IbmCVE-2015-0138HistoryMar 25, 2015 - 1:59 a.m.
CVE-2015-0138
2015-03-2501:59:17
CWE-310
ibm
web.nvd.nist.gov
82
ibm
itds
isds
vulnerability
cipher-downgrade
tls
freak
cve-2015-0138
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
6.2
Confidence
Low
EPSS
0.949
Percentile
99.3%
GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the “FREAK” issue, a different vulnerability than CVE-2015-0204.
Affected configurations
Node
ibmtivoli_directory_serverRange≤6.0.0.73
ORibmtivoli_directory_serverMatch6.1.0
ORibmtivoli_directory_serverMatch6.1.0.0
ORibmtivoli_directory_serverMatch6.1.0.1
ORibmtivoli_directory_serverMatch6.1.0.2
ORibmtivoli_directory_serverMatch6.1.0.3
ORibmtivoli_directory_serverMatch6.1.0.4
ORibmtivoli_directory_serverMatch6.1.0.5
ORibmtivoli_directory_serverMatch6.1.0.6
ORibmtivoli_directory_serverMatch6.1.0.7
ORibmtivoli_directory_serverMatch6.1.0.8
ORibmtivoli_directory_serverMatch6.1.0.9
ORibmtivoli_directory_serverMatch6.1.0.10
ORibmtivoli_directory_serverMatch6.1.0.11
ORibmtivoli_directory_serverMatch6.1.0.12
ORibmtivoli_directory_serverMatch6.1.0.13
ORibmtivoli_directory_serverMatch6.1.0.14
ORibmtivoli_directory_serverMatch6.1.0.15
ORibmtivoli_directory_serverMatch6.1.0.17
ORibmtivoli_directory_serverMatch6.1.0.18
ORibmtivoli_directory_serverMatch6.1.0.19
ORibmtivoli_directory_serverMatch6.1.0.20
ORibmtivoli_directory_serverMatch6.1.0.21
ORibmtivoli_directory_serverMatch6.1.0.22
ORibmtivoli_directory_serverMatch6.1.0.23
ORibmtivoli_directory_serverMatch6.1.0.24
ORibmtivoli_directory_serverMatch6.1.0.25
ORibmtivoli_directory_serverMatch6.1.0.26
ORibmtivoli_directory_serverMatch6.1.0.27
ORibmtivoli_directory_serverMatch6.1.0.28
ORibmtivoli_directory_serverMatch6.1.0.29
ORibmtivoli_directory_serverMatch6.1.0.30
ORibmtivoli_directory_serverMatch6.1.0.31
ORibmtivoli_directory_serverMatch6.1.0.32
ORibmtivoli_directory_serverMatch6.1.0.33
ORibmtivoli_directory_serverMatch6.1.0.34
ORibmtivoli_directory_serverMatch6.1.0.35
ORibmtivoli_directory_serverMatch6.1.0.36
ORibmtivoli_directory_serverMatch6.1.0.37
ORibmtivoli_directory_serverMatch6.1.0.38
ORibmtivoli_directory_serverMatch6.1.0.39
ORibmtivoli_directory_serverMatch6.1.0.40
ORibmtivoli_directory_serverMatch6.1.0.41
ORibmtivoli_directory_serverMatch6.1.0.42
ORibmtivoli_directory_serverMatch6.1.0.43
ORibmtivoli_directory_serverMatch6.1.0.44
ORibmtivoli_directory_serverMatch6.1.0.45
ORibmtivoli_directory_serverMatch6.1.0.46
ORibmtivoli_directory_serverMatch6.1.0.47
ORibmtivoli_directory_serverMatch6.1.0.48
ORibmtivoli_directory_serverMatch6.1.0.49
ORibmtivoli_directory_serverMatch6.1.0.50
ORibmtivoli_directory_serverMatch6.1.0.51
ORibmtivoli_directory_serverMatch6.1.0.52
ORibmtivoli_directory_serverMatch6.1.0.53
ORibmtivoli_directory_serverMatch6.1.0.54
ORibmtivoli_directory_serverMatch6.1.0.55
ORibmtivoli_directory_serverMatch6.1.0.56
ORibmtivoli_directory_serverMatch6.1.0.57
ORibmtivoli_directory_serverMatch6.1.0.58
ORibmtivoli_directory_serverMatch6.1.0.59
ORibmtivoli_directory_serverMatch6.1.0.60
ORibmtivoli_directory_serverMatch6.1.0.61
ORibmtivoli_directory_serverMatch6.1.0.62
ORibmtivoli_directory_serverMatch6.1.0.63
ORibmtivoli_directory_serverMatch6.1.0.64
ORibmtivoli_directory_serverMatch6.1.0.65
ORibmtivoli_directory_serverMatch6.1.0.66
ORibmtivoli_directory_serverMatch6.2.0.0
ORibmtivoli_directory_serverMatch6.2.0.1
ORibmtivoli_directory_serverMatch6.2.0.2
ORibmtivoli_directory_serverMatch6.2.0.3
ORibmtivoli_directory_serverMatch6.2.0.4
ORibmtivoli_directory_serverMatch6.2.0.5
ORibmtivoli_directory_serverMatch6.2.0.6
ORibmtivoli_directory_serverMatch6.2.0.7
ORibmtivoli_directory_serverMatch6.2.0.8
ORibmtivoli_directory_serverMatch6.2.0.10
ORibmtivoli_directory_serverMatch6.2.0.11
ORibmtivoli_directory_serverMatch6.2.0.12
ORibmtivoli_directory_serverMatch6.2.0.13
ORibmtivoli_directory_serverMatch6.2.0.14
ORibmtivoli_directory_serverMatch6.2.0.15
ORibmtivoli_directory_serverMatch6.2.0.19
ORibmtivoli_directory_serverMatch6.2.0.20
ORibmtivoli_directory_serverMatch6.2.0.21
ORibmtivoli_directory_serverMatch6.2.0.22
ORibmtivoli_directory_serverMatch6.2.0.23
ORibmtivoli_directory_serverMatch6.2.0.24
ORibmtivoli_directory_serverMatch6.2.0.25
ORibmtivoli_directory_serverMatch6.2.0.26
ORibmtivoli_directory_serverMatch6.2.0.27
ORibmtivoli_directory_serverMatch6.2.0.29
ORibmtivoli_directory_serverMatch6.2.0.30
ORibmtivoli_directory_serverMatch6.2.0.31
ORibmtivoli_directory_serverMatch6.2.0.32
ORibmtivoli_directory_serverMatch6.2.0.33
ORibmtivoli_directory_serverMatch6.2.0.34
ORibmtivoli_directory_serverMatch6.2.0.35
ORibmtivoli_directory_serverMatch6.2.0.36
ORibmtivoli_directory_serverMatch6.2.0.37
ORibmtivoli_directory_serverMatch6.2.0.38
ORibmtivoli_directory_serverMatch6.2.0.39
ORibmtivoli_directory_serverMatch6.2.0.40
ORibmtivoli_directory_serverMatch6.2.0.41
ORibmtivoli_directory_serverMatch6.2.0.42
ORibmtivoli_directory_serverMatch6.3.0.0
ORibmtivoli_directory_serverMatch6.3.0.1
ORibmtivoli_directory_serverMatch6.3.0.2
ORibmtivoli_directory_serverMatch6.3.0.8
ORibmtivoli_directory_serverMatch6.3.0.9
ORibmtivoli_directory_serverMatch6.3.0.10
ORibmtivoli_directory_serverMatch6.3.0.11
ORibmtivoli_directory_serverMatch6.3.0.12
ORibmtivoli_directory_serverMatch6.3.0.14
ORibmtivoli_directory_serverMatch6.3.0.15
ORibmtivoli_directory_serverMatch6.3.0.17
ORibmtivoli_directory_serverMatch6.3.0.18
ORibmtivoli_directory_serverMatch6.3.0.19
ORibmtivoli_directory_serverMatch6.3.0.21
ORibmtivoli_directory_serverMatch6.3.0.22
ORibmtivoli_directory_serverMatch6.3.0.23
ORibmtivoli_directory_serverMatch6.3.0.24
ORibmtivoli_directory_serverMatch6.3.0.25
ORibmtivoli_directory_serverMatch6.3.0.26
ORibmtivoli_directory_serverMatch6.3.0.27
ORibmtivoli_directory_serverMatch6.3.0.28
ORibmtivoli_directory_serverMatch6.3.0.29
ORibmtivoli_directory_serverMatch6.3.0.30
ORibmtivoli_directory_serverMatch6.3.0.31
ORibmtivoli_directory_serverMatch6.3.0.32
ORibmtivoli_directory_serverMatch6.3.0.33
ORibmtivoli_directory_serverMatch6.3.0.34
ORibmtivoli_directory_serverMatch6.3.0.35
ORibmtivoli_directory_serverMatch6.3.1.0
ORibmtivoli_directory_serverMatch6.3.1.5
ORibmtivoli_directory_serverMatch6.3.1.6
ORibmtivoli_directory_serverMatch6.3.1.7
ORibmtivoli_directory_serverMatch6.3.1.8
ORibmtivoli_directory_serverMatch6.3.1.9
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | tivoli_directory_server | * | cpe:2.3:a:ibm:tivoli_directory_server:*:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.0 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.0:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.1 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.1:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.2 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.2:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.3 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.3:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.4 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.4:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.5 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.5:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.6 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.6:*:*:*:*:*:*:* |
| ibm | tivoli_directory_server | 6.1.0.7 | cpe:2.3:a:ibm:tivoli_directory_server:6.1.0.7:*:*:*:*:*:*:* |
References
lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html
lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html
rhn.redhat.com/errata/RHSA-2015-1006.html
rhn.redhat.com/errata/RHSA-2015-1007.html
rhn.redhat.com/errata/RHSA-2015-1020.html
rhn.redhat.com/errata/RHSA-2015-1021.html
rhn.redhat.com/errata/RHSA-2015-1091.html
www-01.ibm.com/support/docview.wss?uid=swg21698703
www-01.ibm.com/support/docview.wss?uid=swg21883640
www.securityfocus.com/bid/73326
Related
nvd
nvd
nessus
nessus
IBM HTTP Server 8.5.0.0 <= 8.5.5.5 / 8.0.0.0 <= 8.0.0.10 / 7.0.0.0 <= 7.0.0.37 / 6.1.0.0 <= 6.1.0.47 / 6.0.0.0 <= 6.0.2.43 (257477)
2020-12-15 00:00:00
AIX Java Advisory : Multiple Vulnerabilities (Bar Mitzvah)
2015-04-30 00:00:00
IBM DB2 10.5 < Fix Pack 6 Multiple Vulnerabilities (Bar Mitzvah)
2016-04-15 00:00:00
prion
prion
Design/Logic Flaw
2015-03-25 01:59:00
Code injection
2015-01-09 02:59:00
Design/Logic Flaw
2018-01-08 19:29:00
cvelist
cvelist
ibm
ibm
aix
aix
AIX IBM SDK Java JSSE vulnerability
2015-04-13 12:11:24
cisco
cisco
OpenSSL RSA Temporary Key Cryptographic Downgrade Vulnerability
2015-01-13 19:57:19
cisa
cisa
FREAK
2015-03-06 00:00:00
debiancve
debiancve
CVE-2015-0204
2015-01-09 02:59:10
CVE-2015-2319
2018-01-08 19:29:00
hackerone
hackerone
f5
f5
K16139 : OpenSSL vulnerability CVE-2015-0204
2015-10-02 00:00:00
SOL16139 - OpenSSL vulnerability CVE-2015-0204
2015-02-12 00:00:00
openvas
openvas
DTLS: Deprecated DTLSv1.0 Detection
2024-01-09 00:00:00
SSL/TLS: RSA Temporary Key Handling 'RSA_EXPORT' Downgrade Issue (FREAK)
2015-03-06 00:00:00
OpenSSL Information Disclosure Vulnerability (20150319 - 4) - Windows
2021-07-29 00:00:00
thn
thn
'FREAK' — New SSL/TLS Vulnerability Explained
2015-03-03 20:30:00
OpenSSL to Patch Undisclosed High Severity Vulnerability this Thursday
2015-07-06 22:12:00
veracode
veracode
Brute Force Decryption
2017-02-10 01:27:34
ubuntucve
ubuntucve
CVE-2015-0204
2015-01-08 00:00:00
CVE-2015-2319
2015-03-18 00:00:00
cert
cert
SSL/TLS implementations accept export-grade RSA keys (FREAK attack)
2015-03-06 00:00:00
checkpoint_security
checkpoint_security
Check Point response to TLS FREAK Attack (CVE-2015-0204)
2015-03-03 22:00:00
fortinet
fortinet
TLS FREAK Attack
2015-03-04 00:00:00
cve
cve
openssl
openssl
Vulnerability in OpenSSL - RSA silently downgrades to EXPORT_RSA [Client]
2015-01-06 00:00:00
kaspersky
kaspersky
KLA10503 Multiple vulnerabilities in IBM products
2015-03-24 00:00:00
suse
suse
Security update for java-1_7_0-ibm (important)
2015-06-16 22:06:38
Security update for IBM Java (important)
2015-06-18 16:05:20
Security update for IBM Java (important)
2015-06-22 16:04:54
checkpoint_advisories
checkpoint_advisories
SSL Export Cipher Suite (CVE-2015-0204; CVE-2015-1637)
2015-03-04 00:00:00
OpenSSL TLS Export Cipher Suite Downgrade (CVE-2015-0204; CVE-2015-1637)
2015-03-04 00:00:00
CVSS2
4.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
6.2
Confidence
Low
EPSS
0.949
Percentile
99.3%
Related for CVE-2015-0138