CVE-2015-4000
Description
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2015-4000
Vendor advisory: cve@mitre.org — https://www.openssl.org/news/secadv_20150611.txt
Vendor advisory: cve@mitre.org — https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/
Vendor advisory: cve@mitre.org — https://openssl.org/news/secadv/20150611.txt
Vendor advisory: cve@mitre.org — http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Vendor advisory: cve@mitre.org — http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2015-4000.html
Exploits
Metasploit modules
- auxiliary_scanner/ssl/ssl_version · rank 300 · SSL/TLS Version Detection
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 2:3.19.1-1 |
| debian | bullseye | fixed | 2:3.19.1-1 |
| debian | forky | fixed | 2:3.19.1-1 |
| debian | sid | fixed | 2:3.19.1-1 |
| debian | trixie | fixed | 2:3.19.1-1 |
| macos | affected | | |
| suse | 12 | affected | |
| suse | 11.0 | affected | |
| debian | 7.0 | affected | |
| debian | 8.0 | affected | |
| ubuntu | 12.04 | affected | |
| ubuntu | 14.04 | affected | |
| ubuntu | 14.10 | affected | |
| ubuntu | 15.04 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| openssl | openssl | {"startIncluding":"1.0.1","endIncluding":"1.0.1m"} | |
| ibm | content_manager | 8.5 | |
| oracle | jrockit | r28.3.6 | |
| oracle | jdk | 1.6.0 | |
| oracle | jdk | 1.7.0 | |
| oracle | jdk | 1.8.0 | |
| oracle | jre | 1.6.0 | |
| oracle | jre | 1.7.0 | |
| oracle | jre | 1.8.0 | |
| mozilla | network_security_services | 3.19 | |
| oracle | sparc-opl_service_processor | {"endIncluding":"1121"} | |
| apple | safari | - | |
| chrome | - | | |
| microsoft | internet_explorer | - | |
| mozilla | firefox | - | |
| opera | opera_browser | - | |
| mozilla | firefox | 38.1.0 | |
| mozilla | firefox | 39.0 | |
| mozilla | firefox_esr | 31.8 | |
| mozilla | seamonkey | 2.35 | |
| mozilla | thunderbird | 31.8 | |
| mozilla | thunderbird | 38.1 | |
References
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00001.html
- http://marc.info/?l=bugtraq&m=143880121627664&w=2
- http://rhn.redhat.com/errata/RHSA-2015-1243.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
- http://www.securitytracker.com/id/1033208
- http://www.securitytracker.com/id/1032637
- http://marc.info/?l=bugtraq&m=144050121701297&w=2
- http://www.debian.org/security/2016/dsa-3688
- http://www.debian.org/security/2015/dsa-3287
- http://marc.info/?l=bugtraq&m=144493176821532&w=2
- http://www.securitytracker.com/id/1032865
- http://marc.info/?l=bugtraq&m=143557934009303&w=2
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00026.html
- http://www.securitytracker.com/id/1034728
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00005.html
- http://www.securitytracker.com/id/1032656
- http://rhn.redhat.com/errata/RHSA-2016-2056.html
- http://openwall.com/lists/oss-security/2015/05/20/8
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html
- http://marc.info/?l=bugtraq&m=143628304012255&w=2
- http://marc.info/?l=bugtraq&m=144060576831314&w=2
- http://www.securitytracker.com/id/1032475
- http://www.securitytracker.com/id/1032960
CWEs
CWE-310 CWE-295
Verify integrity in audit chain (admin only). AS-IS.