CVE-2016-0270 Weak cryptography in n/a

What is CVE-2016-0270?

CVE-2016-0270 is a medium-severity vulnerability in n/a, published on 8 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue.

Weakness: CWE-200

Which versions are affected by CVE-2016-0270?

It affects 3 products.

Products include Ibm Client Application Access, Ibm Domino, Ibm Notes.

How do I fix CVE-2016-0270?

No fix has been published for CVE-2016-0270 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-0270 being exploited?

There is no known exploitation of CVE-2016-0270 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-1409 Command injection in Client Application Access High 7.8
• CVE-2018-1410 Command injection in Client Application Access High 7.8
• CVE-2018-1411 Command injection in Client Application Access High 7.8
• CVE-2017-1711 Other in Client Application Access High 7.8
• CVE-2017-1714 Privilege escalation in Client Application Access High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vxq9-8hgp-5mw5.