CVE-2016-3099 Weak cryptography in n/a

High 7.5 Published 8 Jun 2017 Updated 5 Aug 2024

Remote attackers can force the use of unintended weak ciphers in mod_ns, compromising communication security.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-3099?

CVE-2016-3099 is a high-severity vulnerability in Redhat Enterprise Linux Desktop, published on 8 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.

Weakness: CWE-327

Which versions are affected by CVE-2016-3099?

It affects 4 products.

Linux distribution packages (8)

`mod_nss` Red Hat:enterprise_linux:7::client	All versions	`0:1.0.14-7.el7`
`mod_nss-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`0:1.0.14-7.el7`
`mod_nss` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.0.14-7.el7`
`mod_nss-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.0.14-7.el7`
`mod_nss` Red Hat:enterprise_linux:7::server	All versions	`0:1.0.14-7.el7`
`mod_nss-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`0:1.0.14-7.el7`
`mod_nss` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.0.14-7.el7`
`mod_nss-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.0.14-7.el7`

Products include Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.

How do I fix CVE-2016-3099?

Apply the vendor's patch.

Is CVE-2016-3099 being exploited?

There is no known exploitation of CVE-2016-3099 in the wild and no public exploit code.

All Redhat Enterprise Linux Desktop vulnerabilities

Sources

Also known as GHSA-6rg6-w3xx-cvm5, MGASA-2016-0197, RHSA-2016:2602, UBUNTU-CVE-2016-3099.