high
7.5
CWE
326
Advisory Published
Updated

CVE-2013-2566: Weak Encryption

First published: Thu Mar 14 2013(Updated: )

A new attack was discovered against TLS that allows an attacker to recover a limited amount of plaintext from a TLS connection when RC4 encryption is used. The attacks arise from statistical flaws in the keystream generated by the RC4 algorithm which become apparent in TLS ciphertexts when the same plaintext is repeatedly encrypted at a fixed location across many TLS sessions. Reference: <a href="http://www.isg.rhul.ac.uk/tls/">http://www.isg.rhul.ac.uk/tls/</a> <a href="http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html">http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html</a>

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Oracle Communications Application Session Controller>=3.0.0<=3.9.1
Oracle HTTP Server=11.1.1.7.0
Oracle HTTP Server=11.1.1.9.0
Oracle HTTP Server=12.1.3.0.0
Oracle HTTP Server=12.2.1.1.0
Oracle HTTP Server=12.2.1.2.0
Oracle Integrated Lights Out Manager Firmware>=3.0.0<=3.2.11
Oracle Integrated Lights Out Manager Firmware>=4.0.0<=4.0.4
Fujitsu SPARC Enterprise M3000 Firmware>=xcp<xcp_1121
Oracle SPARC Enterprise m3000 Server
Fujitsu SPARC Enterprise M4000 Firmware>=xcp<xcp_1121
Fujitsu SPARC Enterprise M4000 Firmware
Fujitsu SPARC Enterprise M5000 Firmware>=xcp<xcp_1121
Oracle SPARC Enterprise m5000 Server
Fujitsu SPARC Enterprise M8000 Firmware>=xcp<xcp_1121
Fujitsu SPARC Enterprise M8000 Firmware
Fujitsu SPARC Enterprise M9000 Firmware>=xcp<xcp_1121
Fujitsu SPARC Enterprise M9000 Firmware
Oracle Fujitsu M10-1 Firmware>=xcp<xcp2280
Oracle Fujitsu M10-1
Oracle Fujitsu M10-4 Firmware>=xcp<xcp2280
Oracle Fujitsu M10-4
fujitsu m10-4s firmware>=xcp<xcp2280
fujitsu m10-4s
Ubuntu Linux=12.04
Ubuntu Linux=12.10
Ubuntu Linux=13.04
Ubuntu Linux=13.10
Mozilla Firefox<25.0.1
Mozilla Firefox ESR<17.0.11
Mozilla Firefox ESR>=24.1.0<24.1.1
Mozilla SeaMonkey<2.22.1
Mozilla Thunderbird<24.1.1
Mozilla Thunderbird ESR<17.0.11
All of
Fujitsu SPARC Enterprise M3000 Firmware>=xcp<xcp_1121
Oracle SPARC Enterprise m3000 Server
All of
Fujitsu SPARC Enterprise M4000 Firmware>=xcp<xcp_1121
Fujitsu SPARC Enterprise M4000 Firmware
All of
Fujitsu SPARC Enterprise M5000 Firmware>=xcp<xcp_1121
Oracle SPARC Enterprise m5000 Server
All of
Fujitsu SPARC Enterprise M8000 Firmware>=xcp<xcp_1121
Fujitsu SPARC Enterprise M8000 Firmware
All of
Fujitsu SPARC Enterprise M9000 Firmware>=xcp<xcp_1121
Fujitsu SPARC Enterprise M9000 Firmware
All of
Oracle Fujitsu M10-1 Firmware>=xcp<xcp2280
Oracle Fujitsu M10-1
All of
Oracle Fujitsu M10-4 Firmware>=xcp<xcp2280
Oracle Fujitsu M10-4
All of
fujitsu m10-4s firmware>=xcp<xcp2280
fujitsu m10-4s
Ubuntu=12.04
Ubuntu=12.10
Ubuntu=13.04
Ubuntu=13.10
Mozilla Firefox<17.0.11
Mozilla Firefox>=24.1.0<24.1.1
GE Web Server
GE Access
GE Access
GE Access
GE Access
GE UR bootloader binary

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2013-2566?

    CVE-2013-2566 is categorized as a medium severity vulnerability due to its potential to leak limited plaintext data from TLS connections using RC4 encryption.

  • How do I fix CVE-2013-2566?

    To fix CVE-2013-2566, disable RC4 encryption in your TLS configuration and switch to a stronger cipher.

  • Which software is affected by CVE-2013-2566?

    CVE-2013-2566 affects various software including GE firmware versions 7.4x to 8.0x and multiple versions of Oracle HTTP Server.

  • Can CVE-2013-2566 be exploited remotely?

    Yes, CVE-2013-2566 can be exploited remotely if an attacker can intercept and manipulate the TLS traffic.

  • What encryption algorithm does CVE-2013-2566 target?

    CVE-2013-2566 specifically targets the RC4 encryption algorithm used in TLS connections.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203