ID

VAR-201505-0233

CVE

CVE-2015-4000

TITLE

TLS Encryption problem vulnerability

DESCRIPTION

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. TLS (full name Transport Layer Security, Secure Transport Layer Protocol) is a set of protocols used to provide confidentiality and data integrity between two communication applications. There is a security vulnerability in the TLS protocol 1.2 and earlier versions. The vulnerability comes from that when the server enables the DHE_EXPORT cipher suite, the program does not pass the DHE_EXPORT option correctly. Attackers can exploit this vulnerability to implement man-in-the-middle attacks and cipher-downgrade attacks by rewriting ClientHello (use DHE_EXPORT instead of DHE) and then rewrite ServerHello (use DHE instead of DHE_EXPORT). v9.1x, v9.2x, v10.0x HP Network Node Manager iSPI Performance for QA v9.0x, v9.1x, v9.2x, v10.0x HP Network Node Manager iSPI for IP Multicast QA v9.0x, v9.1x, v9.2x, v10.0x HP Network Node Manager iSPI for MPLS VPN v9.0x, v9.1x, v9.2x, v10.0x HP Network Node Manager iSPI for IP Telephony v9.0x, v9.1x, v9.2x, v10.0x HP Network Node Manager iSPI for NET v9.0x, v9.1x, v9.2x, v10.0x HP Network Node Manager iSPI Performance for Metrics v9.0x, v9.1x, v9.2x, v10.0x HP Network Node Manager iSPI Performance for Traffic v9.0x, v9.1x, v9.2x, v10.0x BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-4000 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2015-2808 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 CVE-2015-0204 (AV:N/AC:M/Au:N/C:P/I:N/A:N) 4.3 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided the following updates for HP Network Node Manager i and Smart Plugins (iSPIs) HP Network Node Manager i and Smart Plugins (iSPIs) Version Link to update for CVE-2015-4000 (LogJam) HP Network Node Manager i version v9.1x, v9.2x iSPI Performance for QA iSPI for IP Multicast iSPI for MPLS VPN iSPI for IP Telephony https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01704653 HP Network Node Manager iSPI for Metrics v9.1x, v9.2x https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01740484 HP Network Node Manager iSPI for Traffic v9.1x, v9.2x https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01740489 Note: v10.x is not affected by LogJam HP Network Node Manager i and Smart Plugins (iSPIs) Version Link to update for CVE-2015-2808 (Bar Mitzvah) HP Network Node Manager i version v9.1x, v9.2x, v10.x iSPI Performance for QA iSPI for IP Multicast iSPI for MPLS VPN iSPI for IP Telephony https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01704651 HP Network Node Manager iSPI for Metrics v9.1x, v9.2x, v10.0x https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01740486 HP Network Node Manager iSPI for Traffic v9.1x, v9.2x, v10.0x https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01740487 HP Network Node Manager i and Smart Plugins (iSPIs) Version Link to update for CVE-2015-0204 (Freak) HP Network Node Manager i version v9.x, v10.x iSPI Performance for QA iSPI for IP Multicast iSPI for MPLS VPN iSPI for IP Telephony https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01704633https://softwaresupport.hp.com/group/softwaresupport/ search-result/-/facetsearch/document/KM01704633 HP Network Node Manager iSPI for Metrics v9.1x, v9.2x https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01740481 HP Network Node Manager iSPI for Traffic v9.1x, v9.2x https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetse arch/document/KM01740488 Note: v10.x is not affected by FREAK HISTORY Version:1 (rev.1) - 20 August 2015 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. For the oldstable distribution (wheezy), these problems have been fixed in version 6b36-1.13.8-1~deb7u1. We recommend that you upgrade your openjdk-6 packages. HP Performance Manager v9.0x and v9.20. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201701-46 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Mozilla Network Security Service (NSS): Multiple vulnerabilities Date: January 19, 2017 Bugs: #550288, #571086, #604916 ID: 201701-46 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in NSS, the worst of which could allow remote attackers to obtain access to private key information. Background ========== The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/nss < 3.28 >= 3.28 Description =========== Multiple vulnerabilities have been discovered in NSS. Please review the CVE identifiers and technical papers referenced below for details. Impact ====== Remote attackers could conduct man-in-the-middle attacks, obtain access to private key information, or cause a Denial of Service condition. Workaround ========== There is no known workaround at this time. Resolution ========== All NSS users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.28" References ========== [ 1 ] CVE-2015-2721 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2721 [ 2 ] CVE-2015-4000 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-4000 [ 3 ] CVE-2015-7575 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-7575 [ 4 ] CVE-2016-1938 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-1938 [ 5 ] CVE-2016-5285 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-5285 [ 6 ] CVE-2016-8635 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-8635 [ 7 ] CVE-2016-9074 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9074 [ 8 ] SLOTH Attack Technical Paper http://www.mitls.org/pages/attacks/SLOTH Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201701-46 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --IaUA2rjNRE1qkoRse7wxSpqjKrtacOEtO-- . HP Service Manager Software 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40 Server BACKGROUND CVSS Base Metrics ================= Reference, CVSS V3 Score/Vector, CVSS V2 Score/Vector CVE-2015-4000 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) Information on CVSS is documented in HPE Customer Notice HPSN-2008-002 here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay/?docI d=emr_na-c01345499 RESOLUTION HPE has made the following mitigation information available to resolve the vulnerability for the impacted versions of HPE Service Manager: https://softwaresupport.hpe.com/group/softwaresupport/search-result/-/facetse arch/document/KM01728543 For versions 9.30, 9.31, 9.32, 9.33, 9.34 please: Upgrade to SM 9.35.P4 (recommended) or SM 9.34.P5 SM9.35 P4 package, SM 9.35 AIX Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143332 SM 9.35 HP Itanium Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143206 SM 9.35 HP Itanium Server for Oracle 12c 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143388 SM 9.35 Linux Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143530 SM 9.35 Solaris Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143276 SM 9.35 Windows Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143589 SM 9.34.P5 package, AIX Server 9.34.5003 p5 https://softwaresupport.hpe.com/km/KM02310304 HP Itanium Server 9.34.5003 p5 <[https://softwaresupport.hpe.com/km/KM02311066> Linux Server 9.34.5003 p5 https://softwaresupport.hpe.com/km/KM02310566 Solaris Server 9.34.5003 p5 https://softwaresupport.hpe.com/km/KM02311656 Windows Server 9.34.5003 p5 https://softwaresupport.hpe.com/km/KM02310486 For versions 9.35 please: Upgrade to SM 9.35.P4 SM9.35 P4 package, SM 9.35 AIX Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143332 SM 9.35 HP Itanium Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143206 SM 9.35 HP Itanium Server for Oracle 12c 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143388 SM 9.35 Linux Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143530 SM 9.35 Solaris Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143276 SM 9.35 Windows Server 9.35.4001 p4 https://softwaresupport.hpe.com/km/KM02143589 For versions 9.40 please: Upgrade to SM 9.41.P3 SM9.41.P3 package, Service Manager 9.41.3016 p3 - Server for AIX https://softwaresupport.hpe.com/km/KM02236813 Service Manager 9.41.3016 p3 - Server for HP-UX/IA https://softwaresupport.hpe.com/km/KM02236897 Service Manager 9.41.3016 p3 - Server for Linux https://softwaresupport.hpe.com/km/KM02236827 Service Manager 9.41.3016 p3 - Server for Solaris https://softwaresupport.hpe.com/km/KM02236843 Service Manager 9.41.3016 p3 - Server for Windows https://softwaresupport.hpe.com/km/KM02236929 HISTORY Version:1 (rev.1) - 1 July 2016 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running Hewlett Packard Enterprise (HPE) software products should be applied in accordance with the customer's patch management policy. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04760669 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04760669 Version: 1 HPSBUX03388 SSRT102180 rev.1 - HP-UX running OpenSSL, Remote Disclosure of Information NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2015-08-05 Last Updated: 2015-08-05 Potential Security Impact: Remote disclosure of information Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP-UX running OpenSSL with SSL/TLS enabled. This is the TLS vulnerability using US export-grade 512-bit keys in Diffie-Hellman key exchange known as Logjam which could be exploited remotely resulting in disclosure of information. References: CVE-2015-4000: DHE man-in-the-middle protection (Logjam). CVE-2015-1788: Malformed ECParameters causes infinite loop. CVE-2015-1790: PKCS7 crash with missing EnvelopedContent CVE-2015-1791: Race condition handling NewSessionTicket CVE-2015-1792: CMS verify infinite loop with unknown hash function CVE-2015-1793: Alternative Chain Certificate Forgery. SSRT102180 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP-UX B.11.31 running OpenSSL 1.0.1m or earlier. BACKGROUND CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2015-4000 (AV:N/AC:M/Au:N/C:N/I:P/A:N) 4.3 CVE-2015-1788 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2015-1789 (AV:N/AC:M/Au:N/C:N/I:N/A:P) 4.3 CVE-2015-1790 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2015-1791 (AV:N/AC:M/Au:N/C:P/I:P/A:P) 6.8 CVE-2015-1792 (AV:N/AC:L/Au:N/C:N/I:N/A:P) 5.0 CVE-2015-1793 (AV:N/AC:L/Au:N/C:P/I:P/A:N) 6.4 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION HP has provided an updated version of OpenSSL to resolve this vulnerability. A new B.11.31 depot for OpenSSL_A.01.00.01p is available here: https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber =OPENSSL11I MANUAL ACTIONS: Yes - Update PRODUCT SPECIFIC INFORMATION HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see: https://www.hp.com/go/swa The following text is for use by the HP-UX Software Assistant. AFFECTED VERSIONS HP-UX B.11.31 ================== openssl.OPENSSL-CER openssl.OPENSSL-CONF openssl.OPENSSL-DOC openssl.OPENSSL-INC openssl.OPENSSL-LIB openssl.OPENSSL-MAN openssl.OPENSSL-MIS openssl.OPENSSL-PRNG openssl.OPENSSL-PVT openssl.OPENSSL-RUN openssl.OPENSSL-SRC action: install revision A.01.00.01p or subsequent END AFFECTED VERSIONS HISTORY Version:1 (rev.1) - 5 August 2015 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. Support: For issues about implementing the recommendations of this Security Bulletin, contact normal HP Services support channel. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com Subscribe: To initiate a subscription to receive future HP Security Bulletin alerts via Email: http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins Security Bulletin Archive: A list of recently released Security Bulletins is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secBullArchive/ Software Product Category: The Software Product Category is represented in the title by the two characters following HPSB. 3C = 3COM 3P = 3rd Party Software GN = HP General Software HF = HP Hardware and Firmware MP = MPE/iX MU = Multi-Platform Software NS = NonStop Servers OV = OpenVMS PI = Printing and Imaging PV = ProCurve ST = Storage Software TU = Tru64 UNIX UX = HP-UX Copyright 2015 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iEYEARECAAYFAlXCSD4ACgkQ4B86/C0qfVlKnQCg5XcK1amrTACEyDY3QtJF75u2 L90AnAgGXxSCZgBVzDQCAezbHbrHPwtg =74KM -----END PGP SIGNATURE----- . ============================================================================ Ubuntu Security Notice USN-2656-2 July 15, 2015 firefox vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 LTS Summary: Firefox could be made to crash or run programs as your login if it opened a malicious website. Software Description: - firefox: Mozilla Open Source web browser Details: USN-2656-1 fixed vulnerabilities in Firefox for Ubuntu 14.04 LTS and later releases. This update provides the corresponding update for Ubuntu 12.04 LTS. Original advisory details: Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove the forward-secrecy property. (CVE-2015-2721) Looben Yan discovered 2 use-after-free issues when using XMLHttpRequest in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2722, CVE-2015-2733) Bob Clary, Christian Holler, Bobby Holley, Andrew McCreight, Terrence Cole, Steve Fink, Mats Palmgren, Wes Kocher, Andreas Pehrson, Tooru Fujisawa, Andrew Sutherland, and Gary Kwong discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2724, CVE-2015-2725, CVE-2015-2726) Armin Razmdjou discovered that opening hyperlinks with specific mouse and key combinations could allow a Chrome privileged URL to be opened without context restrictions being preserved. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2015-2727) Paul Bandha discovered a type confusion bug in the Indexed DB Manager. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2728) Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to obtain sensitive information. (CVE-2015-2729) Watson Ladd discovered that NSS incorrectly handled Elliptical Curve Cryptography (ECC) multiplication. A remote attacker could possibly use this issue to spoof ECDSA signatures. (CVE-2015-2730) A use-after-free was discovered when a Content Policy modifies the DOM to remove a DOM object. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the priviliges of the user invoking Firefox. (CVE-2015-2731) Ronald Crane discovered multiple security vulnerabilities. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740) David Keeler discovered that key pinning checks can be skipped when an overridable certificate error occurs. This allows a user to manually override an error for a fake certificate, but cannot be exploited on its own. (CVE-2015-2741) Jonas Jenwald discovered that some internal workers were incorrectly executed with a high privilege. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this in combination with another security vulnerability, to execute arbitrary code in a privileged scope. (CVE-2015-2743) Matthew Green discovered a DHE key processing issue in NSS where a MITM could force a server to downgrade TLS connections to 512-bit export-grade cryptography. An attacker could potentially exploit this to impersonate the server. (CVE-2015-4000) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 LTS: firefox 39.0+build5-0ubuntu0.12.04.2 After a standard system update you need to restart Firefox to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2656-2 http://www.ubuntu.com/usn/usn-2656-1 CVE-2015-2721, CVE-2015-2722, CVE-2015-2724, CVE-2015-2725, CVE-2015-2726, CVE-2015-2727, CVE-2015-2728, CVE-2015-2729, CVE-2015-2730, CVE-2015-2731, CVE-2015-2733, CVE-2015-2734, CVE-2015-2735, CVE-2015-2736, CVE-2015-2737, CVE-2015-2738, CVE-2015-2739, CVE-2015-2740, CVE-2015-2741, CVE-2015-2743, CVE-2015-4000 Package Information: https://launchpad.net/ubuntu/+source/firefox/39.0+build5-0ubuntu0.12.04.2 . These vulnerabilities could be exploited remotely to create a Denial of Service (DoS) and other impacts including..

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

encryption problem

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

HP

SOURCES

LAST UPDATE DATE

2026-06-25T20:08:53.401000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE