Vulnerability in Fujitsu Sparc Enterprise M3000
CVE-2015-2808
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
Vulnerability class: POODLE (CVE-2014-3566)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.739 (99.5th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.739 · newest: 0.739 · change: 0.000
Affected products
- Fujitsu Sparc Enterprise M3000
- Fujitsu Sparc Enterprise M3000 Firmware
- Fujitsu Sparc Enterprise M4000
- Fujitsu Sparc Enterprise M4000 Firmware
- Fujitsu Sparc Enterprise M5000
- Fujitsu Sparc Enterprise M5000 Firmware
- Fujitsu Sparc Enterprise M8000
- Fujitsu Sparc Enterprise M8000 Firmware
- Fujitsu Sparc Enterprise M9000
- Fujitsu Sparc Enterprise M9000 Firmware
Weakness classification (CWE)
Public proof-of-concept exploits
References
- marc.info/ (vendor-advisory, Third Party Advisory, Issue Tracking)
- rhn.redhat.com/errata/RHSA-2015-1243.html (vendor-advisory, Third Party Advisory)
- rhn.redhat.com/errata/RHSA-2015-1007.html (vendor-advisory, Third Party Advisory)
- marc.info/ (vendor-advisory, Third Party Advisory, Issue Tracking)
- marc.info/ (vendor-advisory, Third Party Advisory, Issue Tracking)
- www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html (Third Party Advisory)
- rhn.redhat.com/errata/RHSA-2015-1006.html (vendor-advisory, Third Party Advisory)
- h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay (Third Party Advisory)
- kb.juniper.net/JSA10783 (Third Party Advisory)
- www.securitytracker.com/id/1033737 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2015-2808?
- CVE-2015-2808 is a low-severity vulnerability in Fujitsu Sparc Enterprise M3000, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 3.7/10. Published 2015-04-01.
- How severe is CVE-2015-2808?
- Low severity. CVSS v3 base score is 3.7 out of 10.
- Is CVE-2015-2808 known to be exploited?
- 29 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.