PT-2015-1685 · Openssl+1 · Openssl+3

Matt Caswell · Published 2015-03-19 · Updated 2022-12-13 · CVE-2015-0285

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2 through 1.0.2a (excluding 1.0.2a)

Description The issue is related to the ssl3 client hello function in OpenSSL, which does not ensure the proper initialization of the pseudorandom number generator (PRNG) before the handshake procedure. This can be exploited by a remote attacker to bypass cryptographic protection mechanisms by analyzing network traffic and conducting a brute-force attack.

Recommendations For OpenSSL versions 1.0.2 through 1.0.2a (excluding 1.0.2a), update to version 1.0.2a or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific issue.

Fix

DoS

Weakness Enumeration

CWE-310

CWE-335

Related Identifiers

BDU:2015-11031

CVE-2015-0285

Affected Products

Cisco Asa

Cisco Ios Xe

Cisco Nexus

Openssl

References · 23

• https://openssl.org/news/secadv_20150319.txt · Vendor Advisory
• http://marc.info/?l=bugtraq&m=144050155601375&w=2 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=143748090628601&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0285 · Security Note
• https://bdu.fstec.ru/vul/2015-11031 · Security Note
• https://security.gentoo.org/glsa/201503-11 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=144050297101809&w=2 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150320-openssl · Vendor Advisory
• http://oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html · Patch
• https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=e1b568dd2462f7cacf98f3d117936c34e2849a6b · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf · Note
• http://securitytracker.com/id/1031929 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1202410 · Note
• http://fortiguard.com/advisory/2015-03-24-openssl-vulnerabilities-march-2015 · Note
• http://securityfocus.com/bid/73234 · Note