CVE-2016-0270: Infoleak
IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0270?
The severity of CVE-2016-0270 is classified as high due to the potential for remote attackers to spoof data and obtain authentication keys.
How do I fix CVE-2016-0270?
To fix CVE-2016-0270, upgrade to IBM Domino version 9.0.1 Fix Pack 6 or later, or apply the latest available patches.
Which IBM products are affected by CVE-2016-0270?
CVE-2016-0270 affects IBM Domino versions 9.0.1.3 through 9.0.1.5 and IBM Notes versions 9.0.1.3 through 9.0.1.5.
What kind of attacks can CVE-2016-0270 lead to?
CVE-2016-0270 can lead to data spoofing and compromised authentication through nonce reuse in a TLS session.
Is CVE-2016-0270 a local or remote vulnerability?
CVE-2016-0270 is a remote vulnerability, allowing attackers to exploit it over the network.