Microsoft Secure Channel CVE-2015-1637 Man in the Middle Security Bypass Vulnerability

Bugtraq ID:	72965
Class:	Design Error
CVE:	CVE-2015-1637
Remote:	Yes
Local:	No
Published:	Mar 05 2015 12:00AM
Updated:	May 12 2015 07:53PM
Credit:	Microsoft
Vulnerable:	Microsoft Windows Vista Service Pack 2 0 Microsoft Windows Server 2008 R2 for x64-based Systems SP1 Microsoft Windows Server 2008 for x64-based Systems SP2 Microsoft Windows Server 2008 for Itanium-based Systems SP2 Microsoft Windows Server 2008 for 32-bit Systems SP2 Microsoft Windows Server 2003 Itanium SP2 Microsoft Windows Server 2003 SP2 Microsoft Windows 7 for x64-based Systems SP1 Microsoft Windows 7 for 32-bit Systems SP1 Avaya Messaging Application Server 5.2 Avaya CallPilot 5.0 Avaya CallPilot 4.0
Not Vulnerable:

Microsoft Secure Channel CVE-2015-1637 Man in the Middle Security Bypass Vulnerability

Microsoft Secure Channel is prone to a security-bypass vulnerability due to an error in the TLS state machine.

An attacker can exploit this issue to intercept and decrypt the encrypted traffic by conducting a man-in-the-middle attack. This may lead to other attacks.

Microsoft Secure Channel CVE-2015-1637 Man in the Middle Security Bypass Vulnerability

Attackers can use readily available tools to exploit this issue.

Microsoft Secure Channel CVE-2015-1637 Man in the Middle Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Microsoft Secure Channel CVE-2015-1637 Man in the Middle Security Bypass Vulnerability

References:

• Microsoft Homepage (Microsoft)