OpenSSL CVE-2015-0285 Insufficient Entropy Security Weakness
BID:73234
Info
OpenSSL CVE-2015-0285 Insufficient Entropy Security Weakness
| Bugtraq ID: | 73234 |
| Class: | Design Error |
| CVE: |
CVE-2015-0285 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 18 2015 12:00AM |
| Updated: | May 23 2017 04:24PM |
| Credit: | Matt Caswell |
| Vulnerable: |
Rockwell Automation Stratix 5900 0 Oracle Enterprise Manager Ops Center 12.1.0.1 Oracle Enterprise Manager Ops Center 12.1 Oracle Enterprise Manager Ops Center 11.1.3 Oracle Enterprise Manager Ops Center 11.1 Oracle Endeca Server 7.4 Oracle Endeca Server 7.6.1.0.0 Oracle Endeca Server 7.5.1.1 Oracle Endeca Server 7.3.0 Oracle Business Intelligence Enterprise Edition 11.1.1.9 Oracle Business Intelligence Enterprise Edition 11.1.1.7 OpenSSL Project OpenSSL 1.0.2 OpenSSL Project OpenSSL 1.0.2 Beta1 IBM TotalStorage SAN256B Director Model M48 0 IBM System Storage SAN80B-4 0 IBM System Storage SAN768B-2 0 IBM System Storage SAN768B 0 IBM System Storage SAN48B-5 0 IBM System Storage SAN42B-R 0 IBM System Storage SAN40B-4 0 IBM System Storage SAN384B-2 0 IBM System Storage SAN384B 0 IBM System Storage SAN24B-4 0 IBM System Storage SAN06B-R 0 IBM System Storage SAN04B-R 0 IBM System Networking SAN96B-5 0 IBM System Networking SAN24B-5 0 IBM Sterling Integrator 5.1 IBM Sterling B2B Integrator 5.2 IBM Sametime Unified Telephony 8.5.2 IBM Sametime Unified Telephony 9.0 IBM Sametime Community Server 9 Limited Use IBM Sametime Community Server 9 HF1 IBM Sametime 9.0.0.1 IBM Sametime 9.0.0.0 IBM Sametime 8.5.2.1 IBM Sametime 8.5.2.0 IBM Rational Software Architect for WebSphere Software 9.1.1 IBM Rational Software Architect for WebSphere Software 9.1 IBM Rational Software Architect 9.1.1 IBM Rational Software Architect 9.1 IBM Rational Developer for i 9.1.1 IBM Rational Developer for i 9.1.1.1 IBM Rational Developer for i 9.1 IBM Rational Application Developer for WebSphere 9.1.1 IBM Rational Application Developer for WebSphere 9.1.0.1 IBM Rational Application Developer for WebSphere 9.1 IBM QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module 7.10.1.31.00 IBM i operating systems 6.1 IBM i Operating System 7.2 IBM i Operating System 7.1 IBM Flex System FC5022 16Gb SAN Scalable Switch 7.3.0a IBM Flex System FC5022 16Gb SAN Scalable Switch 7.2.1c IBM Flex System FC5022 16Gb SAN Scalable Switch 7.2.0d5 IBM Flex System FC5022 16Gb SAN Scalable Switch 7.0 IBM Flex System EN4023 10Gb Scalable Switch 5.0 IBM Encryption Switch 0 IBM Cognos TM1 10.2.2 IBM Cognos TM1 9.5.2 IBM Cognos TM1 10.2 IBM Cognos TM1 10.1.1 HP Virtual Connect Enterprise Manager SDK 7.4.1 HP Virtual Connect Enterprise Manager SDK 7.4 HP Version Control Repository Manager 7.4.1 HP Version Control Repository Manager 7.4 HP Version Control Repository Manager 7.3.4 HP Version Control Repository Manager 7.3.1 HP Version Control Repository Manager 7.3 HP Version Control Repository Manager 7.2.2 HP Version Control Repository Manager 7.2.1 HP Version Control Repository Manager 7.2 HP Version Control Repository Manager 7.4.0a HP Version Control Repository Manager 7.3.3 HP Version Control Repository Manager 7.3.2 HP Version Control Agent 7.3.4 HP Version Control Agent 7.3.3 HP Version Control Agent 7.3.1 HP Version Control Agent 7.3 HP Version Control Agent 7.2.2 HP Version Control Agent 7.2.1 HP Version Control Agent 7.2 HP Version Control Agent 7.3.2 HP Systems Insight Manager 7.1.1 HP Systems Insight Manager 7.4.0a HP Systems Insight Manager 7.4 HP Systems Insight Manager 7.3.2 HP Systems Insight Manager 7.3.1 HP Systems Insight Manager 7.3.0a HP Systems Insight Manager 7.3 HP Systems Insight Manager 7.2.2 HP Systems Insight Manager 7.2.1 HP Systems Insight Manager 7.2 HP Systems Insight Manager 7.0 HP System Management Homepage (SMH) 7.4 HP System Management Homepage 7.4.1 HP System Management Homepage 7.3.2 HP System Management Homepage 7.2.3 HP System Management Homepage 7.2.2 HP System Management Homepage 7.2.1 HP System Management Homepage 7.2 HP System Management Homepage 7.1.2 HP System Management Homepage 7.1.1 HP System Management Homepage 7.4.0a HP System Management Homepage 7.4 HP System Management Homepage 7.3.3.1 HP System Management Homepage 7.3.1 HP System Management Homepage 7.3 HP System Management Homepage 7.2.4.1 HP System Management Homepage 7.2 HP System Management Homepage 7.1 HP System Management Homepage 7.0 HP Insight Orchestration 0 Avaya Session Border Controller for Enterprise 6.3.0 Avaya one-X Client Enablement Services 6.2 Avaya IP Office Server Edition 9.0 Avaya IP Office Server Edition 8.1 Avaya IP Office Application Server 9.0 Avaya CMS 17.0 Avaya Aura Session Manager 6.2 Avaya Aura Experience Portal 7.0 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 8.0 Avaya Aura Collaboration Environment 3.0 Avaya Aura Collaboration Environment 2.0 |
| Not Vulnerable: |
Rockwell Automation Stratix 5900 15.6.3 Oracle Enterprise Manager Ops Center 12.3 Oracle Enterprise Manager Ops Center 12.2.1 Oracle Enterprise Manager Ops Center 12.2 Oracle Enterprise Manager Ops Center 12.1.4 OpenSSL Project OpenSSL 1.0.2a IBM QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module 7.10.1.35.00 IBM Flex System FC5022 16Gb SAN Scalable Switch 7.3.1 IBM Flex System EN4023 10Gb Scalable Switch 6.0 HP Virtual Connect Enterprise Manager SDK 7.5.0 HP Version Control Repository Manager 7.5.0 HP Version Control Agent 7.3.5 HP Version Control Agent 7.5.0 HP Systems Insight Manager 7.5.0 HP System Management Homepage (SMH) 7.5 HP System Management Homepage 7.5 HP Insight Orchestration 7.5.0 |
Discussion
OpenSSL CVE-2015-0285 Insufficient Entropy Security Weakness
OpenSSL is prone to a security weakness.
An attacker can exploit this issue to guess the generated key that can aid in further attacks.
OpenSSL versions prior to 1.0.2a are vulnerable.
Note: This issue was previously discussed in BID 73196 (OpenSSL Multiple UnspecifiedSecurity Vulnerabilities) but has been given its own record to better document it.
OpenSSL is prone to a security weakness.
An attacker can exploit this issue to guess the generated key that can aid in further attacks.
OpenSSL versions prior to 1.0.2a are vulnerable.
Note: This issue was previously discussed in BID 73196 (OpenSSL Multiple UnspecifiedSecurity Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
OpenSSL CVE-2015-0285 Insufficient Entropy Security Weakness
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
References
OpenSSL CVE-2015-0285 Insufficient Entropy Security Weakness
References:
References:
- OpenSSL Homepage (OpenSSL)
- Advisory (ICSA-17-094-04)Rockwell Automation Stratix 5900 (CERT)
- HP System Management Homepage (SMH) on Linux and Windows, Multiple Vulnerabiliti (HP)
- HPSBMU03397 rev.1 - HP Version Control Agent (VCA) on Windows and Linux, Multipl (HP)
- HPSBMU03409 rev.1 - HP Matrix Operating Environment, Multiple Vulnerabilities (hp)
- IBM Advisory swg21966177 (IBM)
- IBM i is affected by several OpenSSL vulnerabilities. (IBM)
- OpenSSL Security Advisory [19 Mar 2015] (OpenSSL )
- OpenSSL vulnerabilities (OpenSSL)
- Oracle Critical Patch Update Advisory - January 2016 (Oracle)
- Security Bulletin: Multiple Security Issues in IBM Media Server Due to OpenSSL I (IBM)
- Security Bulletin: Vulnerabilities in OpenSSL affect IBM Flex System FC5022 16Gb (IBM)
- Security Bulletin: Vulnerabilities in OpenSSL affect QLogic 8Gb Intelligent Pass (IBM)
- Security Bulletin: Vulnerabilities in OpenSSL affect the Cordova platform packag (IBM)
- Security Bulletin: Vulnerabilities in OpenSSL including ClientHello DoS affect I (IBM)
- swg21964686 - Security Bulletin: Vulnerabilities in OpenSSL affecting Sametime U (IBM)
- Vulnerabilities in OpenSSL affects Rational Application Developer for WebSphere (IBM)
- Vulnerabilities in OpenSSL affects Rational Software Architect for Websphere Sof (IBM)