CNVD-2015-02171

Vulnerability from cnvd - Published: 2015-04-03
VLAI
Title
SSL/TLS协议加密算法RC4存在漏洞
Description
SSL（Secure Sockets Layer，安全套接层）及TLS（Transport Layer Security，传输层安全）是为网络通信提供安全及数据完整性的一种安全协议。TLS与SSL在传输层对网络连接进行加密，是一个被广泛使用的加密协议。 SSL/TLS协议加密算法RC4存在漏洞。由于通过“受戒礼”攻击，攻击者可以在特定环境下只通过嗅探监听就可以还原采用RC4保护的加密信息中的纯文本，导致账户、密码、信用卡信息等重要敏感信息泄露，并且可以通过中间人攻击（Man-in-the-middle）进行会话劫持。
Severity
高
Patch Name
SSL/TLS协议加密算法RC4存在漏洞的补丁
Patch Description
SSL（Secure Sockets Layer，安全套接层）及TLS（Transport Layer Security，传输层安全）是为网络通信提供安全及数据完整性的一种安全协议。TLS与SSL在传输层对网络连接进行加密，是一个被广泛使用的加密协议。 SSL/TLS协议加密算法RC4存在漏洞。由于通过“受戒礼”攻击，攻击者可以在特定环境下只通过嗅探监听就可以还原采用RC4保护的加密信息中的纯文本，导致账户、密码、信用卡信息等重要敏感信息泄露，并且可以通过中间人攻击（Man-in-the-middle）进行会话劫持。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： http://www.freebuf.com/articles/network/62442.html

Reference
http://www.freebuf.com/articles/network/62442.html
Impacted products
Name
['Microsoft IIS null', 'Mozilla Firefox null', 'Opera Opera Browser null', 'Apple Safari', 'Google Chrome', 'IBM WebSphere Application Server', 'RedHat JBoss', 'Oracle Glassfish', 'Microsoft IE']
Show details on source website
To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "73684"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-2808"
    }
  },
  "description": "SSL\uff08Secure Sockets Layer\uff0c\u5b89\u5168\u5957\u63a5\u5c42\uff09\u53caTLS\uff08Transport Layer Security\uff0c\u4f20\u8f93\u5c42\u5b89\u5168\uff09\u662f\u4e3a\u7f51\u7edc\u901a\u4fe1\u63d0\u4f9b\u5b89\u5168\u53ca\u6570\u636e\u5b8c\u6574\u6027\u7684\u4e00\u79cd\u5b89\u5168\u534f\u8bae\u3002TLS\u4e0eSSL\u5728\u4f20\u8f93\u5c42\u5bf9\u7f51\u7edc\u8fde\u63a5\u8fdb\u884c\u52a0\u5bc6\uff0c\u662f\u4e00\u4e2a\u88ab\u5e7f\u6cdb\u4f7f\u7528\u7684\u52a0\u5bc6\u534f\u8bae\u3002\r\n\r\nSSL/TLS\u534f\u8bae\u52a0\u5bc6\u7b97\u6cd5RC4\u5b58\u5728\u6f0f\u6d1e\u3002\u7531\u4e8e\u901a\u8fc7\u201c\u53d7\u6212\u793c\u201d\u653b\u51fb\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u7279\u5b9a\u73af\u5883\u4e0b\u53ea\u901a\u8fc7\u55c5\u63a2\u76d1\u542c\u5c31\u53ef\u4ee5\u8fd8\u539f\u91c7\u7528RC4\u4fdd\u62a4\u7684\u52a0\u5bc6\u4fe1\u606f\u4e2d\u7684\u7eaf\u6587\u672c\uff0c\u5bfc\u81f4\u8d26\u6237\u3001\u5bc6\u7801\u3001\u4fe1\u7528\u5361\u4fe1\u606f\u7b49\u91cd\u8981\u654f\u611f\u4fe1\u606f\u6cc4\u9732\uff0c\u5e76\u4e14\u53ef\u4ee5\u901a\u8fc7\u4e2d\u95f4\u4eba\u653b\u51fb\uff08Man-in-the-middle\uff09\u8fdb\u884c\u4f1a\u8bdd\u52ab\u6301\u3002",
  "discovererName": "Itsik Mantin",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttp://www.freebuf.com/articles/network/62442.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-02171",
  "openTime": "2015-04-03",
  "patchDescription": "SSL\uff08Secure Sockets Layer\uff0c\u5b89\u5168\u5957\u63a5\u5c42\uff09\u53caTLS\uff08Transport Layer Security\uff0c\u4f20\u8f93\u5c42\u5b89\u5168\uff09\u662f\u4e3a\u7f51\u7edc\u901a\u4fe1\u63d0\u4f9b\u5b89\u5168\u53ca\u6570\u636e\u5b8c\u6574\u6027\u7684\u4e00\u79cd\u5b89\u5168\u534f\u8bae\u3002TLS\u4e0eSSL\u5728\u4f20\u8f93\u5c42\u5bf9\u7f51\u7edc\u8fde\u63a5\u8fdb\u884c\u52a0\u5bc6\uff0c\u662f\u4e00\u4e2a\u88ab\u5e7f\u6cdb\u4f7f\u7528\u7684\u52a0\u5bc6\u534f\u8bae\u3002 \r\n\r\nSSL/TLS\u534f\u8bae\u52a0\u5bc6\u7b97\u6cd5RC4\u5b58\u5728\u6f0f\u6d1e\u3002\u7531\u4e8e\u901a\u8fc7\u201c\u53d7\u6212\u793c\u201d\u653b\u51fb\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u5728\u7279\u5b9a\u73af\u5883\u4e0b\u53ea\u901a\u8fc7\u55c5\u63a2\u76d1\u542c\u5c31\u53ef\u4ee5\u8fd8\u539f\u91c7\u7528RC4\u4fdd\u62a4\u7684\u52a0\u5bc6\u4fe1\u606f\u4e2d\u7684\u7eaf\u6587\u672c\uff0c\u5bfc\u81f4\u8d26\u6237\u3001\u5bc6\u7801\u3001\u4fe1\u7528\u5361\u4fe1\u606f\u7b49\u91cd\u8981\u654f\u611f\u4fe1\u606f\u6cc4\u9732\uff0c\u5e76\u4e14\u53ef\u4ee5\u901a\u8fc7\u4e2d\u95f4\u4eba\u653b\u51fb\uff08Man-in-the-middle\uff09\u8fdb\u884c\u4f1a\u8bdd\u52ab\u6301\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SSL/TLS\u534f\u8bae\u52a0\u5bc6\u7b97\u6cd5RC4\u5b58\u5728\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft IIS null",
      "Mozilla Firefox null",
      "Opera Opera Browser null",
      "Apple  Safari",
      "Google Chrome",
      "IBM WebSphere Application Server",
      "RedHat JBoss",
      "Oracle Glassfish",
      "Microsoft IE"
    ]
  },
  "referenceLink": "http://www.freebuf.com/articles/network/62442.html",
  "serverity": "\u9ad8",
  "submitTime": "2015-04-02",
  "title": "SSL/TLS\u534f\u8bae\u52a0\u5bc6\u7b97\u6cd5RC4\u5b58\u5728\u6f0f\u6d1e"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.