CVE-2015-3197: Infoleak

Published Feb 15, 2016

Updated

ssl/s2srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the getclientmasterkey and getclienthello functions.

Affected Software

38 affected components

ORACLE Tuxedo=12.1.1.0

ORACLE Exalogic Infrastructure=1.0

ORACLE Exalogic Infrastructure=2.0

ORACLE PeopleSoft Enterprise PeopleTools=8.53

ORACLE PeopleSoft Enterprise PeopleTools=8.54

ORACLE PeopleSoft Enterprise PeopleTools=8.55

OpenSSL OpenSSL=1.0.1

OpenSSL OpenSSL=1.0.1-beta1

OpenSSL OpenSSL=1.0.1-beta2

OpenSSL OpenSSL=1.0.1-beta3

OpenSSL OpenSSL=1.0.1a

OpenSSL OpenSSL=1.0.1b

OpenSSL OpenSSL=1.0.1c

OpenSSL OpenSSL=1.0.1d

OpenSSL OpenSSL=1.0.1e

OpenSSL OpenSSL=1.0.1f

OpenSSL OpenSSL=1.0.1g

OpenSSL OpenSSL=1.0.1h

OpenSSL OpenSSL=1.0.1i

OpenSSL OpenSSL=1.0.1j

OpenSSL OpenSSL=1.0.1k

OpenSSL OpenSSL=1.0.1l

OpenSSL OpenSSL=1.0.1m

OpenSSL OpenSSL=1.0.1n

OpenSSL OpenSSL=1.0.1o

OpenSSL OpenSSL=1.0.1p

OpenSSL OpenSSL=1.0.1q

OpenSSL OpenSSL=1.0.2

OpenSSL OpenSSL=1.0.2-beta1

OpenSSL OpenSSL=1.0.2-beta2

OpenSSL OpenSSL=1.0.2-beta3

OpenSSL OpenSSL=1.0.2a

OpenSSL OpenSSL=1.0.2b

OpenSSL OpenSSL=1.0.2c

OpenSSL OpenSSL=1.0.2d

OpenSSL OpenSSL=1.0.2e

ORACLE OSS Support Tools=8.11.16.3.8

ORACLE VM VirtualBox=5.0.16

Remediation

Patch Available

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Event History

Feb 15, 2016

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-3197?

CVE-2015-3197 is classified as a high severity vulnerability due to its potential to facilitate man-in-the-middle attacks.

How do I fix CVE-2015-3197?

To fix CVE-2015-3197, upgrade OpenSSL to version 1.0.1r or 1.0.2f or later.

Which applications are affected by CVE-2015-3197?

CVE-2015-3197 affects OpenSSL 1.0.1 versions prior to 1.0.1r and 1.0.2 versions prior to 1.0.2f, including various Oracle products.

What types of attacks can exploit CVE-2015-3197?

CVE-2015-3197 can be exploited for man-in-the-middle attacks that leverage disabled ciphers.

Is CVE-2015-3197 still a concern in 2023?

Yes, CVE-2015-3197 remains a concern if affected software is still in use without the necessary updates applied.