Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04779034Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10727Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00039.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00040.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00046.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00000.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00005.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=143456209711959&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143629696317098&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143741441012338&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143817021313142&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143817899717054&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=143818140118771&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144043644216842&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144059660127919&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144059703728085&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144060576831314&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144060606031437&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144069189622016&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144102017024820&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144104533800819&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144104565600964&w=2Issue Tracking, Third Party Advisory
http://marc.info/?l=bugtraq&m=144493176821532&w=2Issue Tracking, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1006.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1007.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1020.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1021.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1091.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1228.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1229.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1230.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1241.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1242.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1243.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1526.htmlThird Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV71888Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IV71892Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21883640Third Party Advisory
http://www-304.ibm.com/support/docview.wss?uid=swg21903565Third Party Advisory
http://www-304.ibm.com/support/docview.wss?uid=swg21960015Third Party Advisory
http://www-304.ibm.com/support/docview.wss?uid=swg21960769Third Party Advisory
http://www.debian.org/security/2015/dsa-3316Third Party Advisory
http://www.debian.org/security/2015/dsa-3339Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/hw-454055Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlThird Party Advisory
http://www.securityfocus.com/bid/73684Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91787Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032599Third Party Advisory, VDB Entry

Timeline

Published: Apr 1, 2015
Last modified: Jun 17, 2026
NVD status: Modified

CVE-2015-2808