cve-2015-8960
Vulnerability from cvelistv5
Published
2016-09-21 01:00
Modified
2024-08-06 08:36
Severity ?
EPSS score ?
Summary
The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-06T08:36:30.681Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "[oss-security] 20160920 Re: Possible CVE for TLS protocol issue", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "http://www.openwall.com/lists/oss-security/2016/09/20/4", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "http://twitter.com/matthew_d_green/statuses/630908726950674433", }, { name: "93071", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/93071", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://security.netapp.com/advisory/ntap-20180626-0002/", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf", }, { tags: [ "x_refsource_MISC", "x_transferred", ], url: "https://kcitls.org", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2015-11-08T00:00:00", descriptions: [ { lang: "en", value: "The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the \"Key Compromise Impersonation (KCI)\" issue.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2018-06-27T09:57:01", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { name: "[oss-security] 20160920 Re: Possible CVE for TLS protocol issue", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "http://www.openwall.com/lists/oss-security/2016/09/20/4", }, { tags: [ "x_refsource_MISC", ], url: "http://twitter.com/matthew_d_green/statuses/630908726950674433", }, { name: "93071", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/93071", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://security.netapp.com/advisory/ntap-20180626-0002/", }, { tags: [ "x_refsource_MISC", ], url: "https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf", }, { tags: [ "x_refsource_MISC", ], url: "https://kcitls.org", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2015-8960", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the \"Key Compromise Impersonation (KCI)\" issue.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "[oss-security] 20160920 Re: Possible CVE for TLS protocol issue", refsource: "MLIST", url: "http://www.openwall.com/lists/oss-security/2016/09/20/4", }, { name: "http://twitter.com/matthew_d_green/statuses/630908726950674433", refsource: "MISC", url: "http://twitter.com/matthew_d_green/statuses/630908726950674433", }, { name: "93071", refsource: "BID", url: "http://www.securityfocus.com/bid/93071", }, { name: "https://security.netapp.com/advisory/ntap-20180626-0002/", refsource: "CONFIRM", url: "https://security.netapp.com/advisory/ntap-20180626-0002/", }, { name: "https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf", refsource: "MISC", url: "https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf", }, { name: "https://kcitls.org", refsource: "MISC", url: "https://kcitls.org", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2015-8960", datePublished: "2016-09-21T01:00:00", dateReserved: "2016-09-20T00:00:00", dateUpdated: "2024-08-06T08:36:30.681Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ietf:transport_layer_security:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1.2\", \"matchCriteriaId\": \"B20CCEB2-5534-4263-ACEA-C0A928CB6414\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:apple:safari:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AFDA34B4-65B4-41A5-AC22-667C8D8FF4B7\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:google:chrome:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"39B565E1-C2F1-44FC-A517-E3130332B17C\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C37BA825-679F-4257-9F2B-CE2318B75396\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"97D4FFCF-5309-43B6-9FD5-680C6D535A7F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:opera:opera_browser:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4545786D-3129-4D92-B218-F4A92428ED48\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"62347994-1353-497C-9C4A-D5D8D95F67E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0C4B1E5-75BF-43AE-BBAC-0DD4124C71ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:host_agent:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"546855F3-654C-48F0-B3A0-FF1ABBF04007\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3BD81527-A341-42C3-9AB9-880D3DB04B08\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FFE0A9D2-9A49-4BF6-BC6F-8249162D8334\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4BB0FDCF-3750-44C6-AC5C-0CC2AAD14093\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F4754FB-E3EB-454A-AB1A-AE3835C5350C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:*\", \"matchCriteriaId\": \"61D7EF01-F618-497F-9375-8003CEA3D380\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*\", \"matchCriteriaId\": \"BEDE62C6-D571-4AF8-B85E-CBBCE4AF98B5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*\", \"matchCriteriaId\": \"26A2B713-7D6D-420A-93A4-E0D983C983DF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*\", \"matchCriteriaId\": \"64DE38C8-94F1-4860-B045-F33928F676A8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F74F467A-0C81-40D9-BA06-40FB8EF02C04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:solidfire_\\\\&_hci_management_node:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D6D700C5-F67F-4FFB-BE69-D524592A3D2E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:system_setup:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"459CF8B6-B815-42EA-A286-6E737529D9AC\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the \\\"Key Compromise Impersonation (KCI)\\\" issue.\"}, {\"lang\": \"es\", \"value\": \"El protocolo TLS 1.2 y versiones anteriores soporta los valores rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh y ecdsa_fixed_ecdh para ClientCertificateType pero no documenta directamente la habilidad para computar el secreto maestro en determinadas situaciones con una clave de cliente secreta y una clave p\\u00fablica de servidor pero no una clave secreta de servidor, lo que facilita a atacantes man-in-the-middle suplantar servidores TLS aprovechando el conocimiento de la clave secreta para un certificado cliente X.509 arbitrariamente instalado, tambi\\u00e9n conocido como problema \\\"Key Compromise Impersonation (KCI)\\\".\"}]", id: "CVE-2015-8960", lastModified: "2024-11-21T02:39:32.840", metrics: "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}", published: "2016-09-21T02:59:00.133", references: "[{\"url\": \"http://twitter.com/matthew_d_green/statuses/630908726950674433\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Press/Media Coverage\", \"Technical Description\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/09/20/4\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Mailing List\", \"Technical Description\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/93071\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Broken Link\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://kcitls.org\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Technical Description\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20180626-0002/\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Mitigation\", \"Technical Description\"]}, {\"url\": \"http://twitter.com/matthew_d_green/statuses/630908726950674433\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Press/Media Coverage\", \"Technical Description\", \"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/09/20/4\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Technical Description\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/93071\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://kcitls.org\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Technical Description\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20180626-0002/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Mitigation\", \"Technical Description\"]}]", sourceIdentifier: "secalert@redhat.com", vulnStatus: "Modified", weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-295\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2015-8960\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-09-21T02:59:00.133\",\"lastModified\":\"2024-11-21T02:39:32.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the \\\"Key Compromise Impersonation (KCI)\\\" issue.\"},{\"lang\":\"es\",\"value\":\"El protocolo TLS 1.2 y versiones anteriores soporta los valores rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh y ecdsa_fixed_ecdh para ClientCertificateType pero no documenta directamente la habilidad para computar el secreto maestro en determinadas situaciones con una clave de cliente secreta y una clave pública de servidor pero no una clave secreta de servidor, lo que facilita a atacantes man-in-the-middle suplantar servidores TLS aprovechando el conocimiento de la clave secreta para un certificado cliente X.509 arbitrariamente instalado, también conocido como problema \\\"Key Compromise Impersonation (KCI)\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.2,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ietf:transport_layer_security:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1.2\",\"matchCriteriaId\":\"B20CCEB2-5534-4263-ACEA-C0A928CB6414\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:apple:safari:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AFDA34B4-65B4-41A5-AC22-667C8D8FF4B7\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:google:chrome:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39B565E1-C2F1-44FC-A517-E3130332B17C\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C37BA825-679F-4257-9F2B-CE2318B75396\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97D4FFCF-5309-43B6-9FD5-680C6D535A7F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:opera:opera_browser:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4545786D-3129-4D92-B218-F4A92428ED48\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"62347994-1353-497C-9C4A-D5D8D95F67E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:data_ontap_edge:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0C4B1E5-75BF-43AE-BBAC-0DD4124C71ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:host_agent:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"546855F3-654C-48F0-B3A0-FF1ABBF04007\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_shift:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BD81527-A341-42C3-9AB9-880D3DB04B08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FFE0A9D2-9A49-4BF6-BC6F-8249162D8334\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BB0FDCF-3750-44C6-AC5C-0CC2AAD14093\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F4754FB-E3EB-454A-AB1A-AE3835C5350C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:unix:*:*\",\"matchCriteriaId\":\"61D7EF01-F618-497F-9375-8003CEA3D380\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapdrive:-:*:*:*:*:windows:*:*\",\"matchCriteriaId\":\"BEDE62C6-D571-4AF8-B85E-CBBCE4AF98B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*\",\"matchCriteriaId\":\"26A2B713-7D6D-420A-93A4-E0D983C983DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*\",\"matchCriteriaId\":\"64DE38C8-94F1-4860-B045-F33928F676A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapprotect:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F74F467A-0C81-40D9-BA06-40FB8EF02C04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:solidfire_\\\\&_hci_management_node:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6D700C5-F67F-4FFB-BE69-D524592A3D2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:system_setup:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"459CF8B6-B815-42EA-A286-6E737529D9AC\"}]}]}],\"references\":[{\"url\":\"http://twitter.com/matthew_d_green/statuses/630908726950674433\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Press/Media Coverage\",\"Technical Description\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/09/20/4\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Technical Description\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/93071\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://kcitls.org\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Technical Description\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20180626-0002/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Technical Description\"]},{\"url\":\"http://twitter.com/matthew_d_green/statuses/630908726950674433\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Press/Media Coverage\",\"Technical Description\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/09/20/4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Technical Description\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/93071\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://kcitls.org\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Technical Description\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20180626-0002/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mitigation\",\"Technical Description\"]}]}}", }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.