CVE-2015-3197 Weak cryptography in n/a
Man-in-the-middle attackers can defeat cryptographic protections by exploiting disabled cipher usage in SSLv2 traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3197?
CVE-2015-3197 is a medium-severity vulnerability in Openssl Openssl, published on 15 Feb 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.
Which versions are affected by CVE-2015-3197?
It affects 6 products.
Products include Openssl Openssl, Oracle Exalogic Infrastructure, Oracle Oss Support Tools, Oracle Peoplesoft Enterprise Peopletools, Oracle Tuxedo, Oracle Vm Virtualbox.
How do I fix CVE-2015-3197?
Upgrade to a fixed version.
Is CVE-2015-3197 being exploited?
There is no known exploitation of CVE-2015-3197 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Openssl Openssl
Sources
Also known as CVE-2016-3197, DEBIAN-CVE-2015-3197, DLA-421-1, GHSA-7cfp-xp7x-9xqq.