PT-2016-3603 · Erlang+1 · Erlang/Otp+1

Brian Smith + 2 · Publicado 2015-05-05 · Atualizado 2023-02-21 · CVE-2015-2774

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions prior to 18.0-rc1

Description The issue makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of the POODLE attack. This occurs because Erlang/OTP does not properly check CBC padding bytes when terminating connections.

Recommendations For versions prior to 18.0-rc1, update to version 18.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data until the update can be applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-2774

MGASA-2015-0192

USN-3571-1

Produtos afetados

Erlang/Otp

Ubuntu

Referências · 31

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py · Nota
• https://ubuntu.com/security/CVE-2014-1693 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-2774 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10253 · Nota de Segurança
• https://imperialviolet.org/2014/12/08/poodleagain.html · Nota
• https://ubuntu.com/security/CVE-2017-1000385 · Aviso do Fabricante
• https://usn.ubuntu.com/3571-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-3571-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-2774 · Aviso do Fabricante
• https://web.archive.org/web/20150905124006/http://erlang.org/news/85 · Nota
• https://advisories.mageia.org/MGASA-2015-0192.html · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2015-2774 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1693 · Nota de Segurança
• http://openwall.com/lists/oss-security/2015/03/27/9 · Nota
• https://cve.org/CVERecord?id=CVE-2015-2774 · Nota de Segurança