CVE-2015-1716: Infoleak

Published May 13, 2015

Updated

Schannel in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict Diffie-Hellman Ephemeral (DHE) key lengths, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, aka "Schannel Information Disclosure Vulnerability."

Affected Software

12 affected components

Microsoft Windows 7=sp1

Microsoft Windows 8

Microsoft Windows 8.1

Microsoft Windows RT

Microsoft Windows RT 8.1

Microsoft Windows Server 2003=sp2

Microsoft Windows Server 2008=sp2

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Microsoft Windows Vista=sp2

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-055

Event History

May 13, 2015

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1716?

CVE-2015-1716 has a severity rating of important, indicating potential impact on confidentiality and integrity.

How do I fix CVE-2015-1716?

To fix CVE-2015-1716, apply the security updates provided by Microsoft for affected versions of Windows.

Which systems are affected by CVE-2015-1716?

CVE-2015-1716 affects Microsoft Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2003 SP2, Server 2008 SP2, Server 2012, and Windows Vista SP2.

What types of attacks can exploit CVE-2015-1716?

CVE-2015-1716 can be exploited in man-in-the-middle attacks due to improper restriction on Diffie-Hellman key lengths.

Is CVE-2015-1716 related to encryption vulnerabilities?

Yes, CVE-2015-1716 is related to encryption vulnerabilities specifically involving Diffie-Hellman Ephemeral key lengths.