NetSight
IP …
medium5.9

CVE-2015-3197

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle atta…

Impact

ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the get_client_master_key and get_client_hello functions.

Affected products

VendorProductAffected versions
OracleTuxedo
Version 12.1.1.0
OracleExalogic Infrastructure
Versions 1.0, 2.0
OraclePeoplesoft Enterprise Peopletools
Versions 8.53, 8.54, 8.55
OpensslOpenssl
Versions 1.0.1, 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, 1.0.1e
OracleOss Support Tools
Version 8.11.16.3.8
OracleVm Virtualbox
Version 5.0.16

Weakness classification

CWE-200CWE-310

References