CVE-2015-3276: High severity red hat openldap servers vulnerability
The nssparseciphers function in libraries/libldap/tlsm.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.
Other sources
The openldap (for NSS) emulation of the openssl cipherstring parsing code incorrectly implements the multi-keyword mode. As a consequence anyone using a combination like:
ECDH+SHA
will not get the expected set of ciphers
ECDH-RSA-RC4-SHA ECDH-RSA-DES-CBC3-SHA ECDH-RSA-AES128-SHA ECDH-RSA-AES256-SHA ECDH-ECDSA-RC4-SHA ECDH-ECDSA-DES-CBC3-SHA ECDH-ECDSA-AES128-SHA ECDH-ECDSA-AES256-SHA ECDHE-RSA-RC4-SHA ECDHE-RSA-DES-CBC3-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-RC4-SHA ECDHE-ECDSA-DES-CBC3-SHA ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA
but instead will match
DES-CBC-SHA DES-CBC3-SHA RC4-SHA EDH-RSA-DES-CBC-SHA EDH-RSA-DES-CBC3-SHA EDH-DSS-DES-CBC-SHA EDH-DSS-DES-CBC3-SHA EXP1024-DES-CBC-SHA EXP1024-RC4-SHA SEED-SHA AES128-SHA AES256-SHA CAMELLIA256-SHA CAMELLIA128-SHA DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-CAMELLIA128-SHA DHE-RSA-CAMELLIA256-SHA DHE-DSS-RC4-SHA DHE-DSS-AES128-SHA DHE-DSS-AES256-SHA DHE-DSS-CAMELLIA128-SHA DHE-DSS-CAMELLIA256-SHA ECDH-RSA-RC4-SHA ECDH-RSA-DES-CBC3-SHA ECDH-RSA-AES128-SHA ECDH-RSA-AES256-SHA ECDH-ECDSA-RC4-SHA ECDH-ECDSA-DES-CBC3-SHA ECDH-ECDSA-AES128-SHA ECDH-ECDSA-AES256-SHA ECDHE-RSA-RC4-SHA ECDHE-RSA-DES-CBC3-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-RC4-SHA ECDHE-ECDSA-DES-CBC3-SHA ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA
Acknowledgements:
This issue was discovered by Martin Poole of the Red Hat Software Maintenance Engineering group.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3276?
CVE-2015-3276 has a medium severity classification, indicating potential risk due to improper cipher string parsing.
How do I fix CVE-2015-3276?
To fix CVE-2015-3276, you should upgrade to a patched version of OpenLDAP that resolves the cipher string parsing issue.
What are the potential impacts of CVE-2015-3276?
The potential impact of CVE-2015-3276 includes the usage of weaker ciphers, which may allow remote attackers to exploit security vulnerabilities.
Which software versions are affected by CVE-2015-3276?
CVE-2015-3276 affects various versions of OpenLDAP prior to 2.5, along with several versions of Red Hat and Oracle Linux.
Is CVE-2015-3276 a remote attack vector?
Yes, CVE-2015-3276 can be exploited by remote attackers through unspecified vectors due to the vulnerability in cipher string parsing.