CVE-2015-2808 (CNNVD-201503-654)

MEDIUM
中文标题:
RC4 加密问题漏洞
英文标题:
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state dat...
CVSS分数: 5.0
发布时间: 2015-04-01 00:00:00
漏洞类型: 加密问题
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

RC4是美国软件开发者罗纳德-李维斯特（Ron Rivest）所研发的一套密钥长度可变的流加密算法。该算法由伪随机数生成器和异或运算组成，且支持加解密使用相同的密钥。 TLS协议和SSL协议中使用的RC4算法中存在安全漏洞，该漏洞源于程序在初始化阶段没有正确组合状态数据和密钥数据。远程攻击者可通过嗅探特定的网络流量，然后实施暴力破解攻击利用该漏洞对数据流中的初始化字节实施plaintext-recovery攻击。

英文描述:

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

CWE类型:
CWE-327
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
oracle communications_application_session_controller * - - cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:*
oracle communications_policy_management * - - cpe:2.3:a:oracle:communications_policy_management:*:*:*:*:*:*:*:*
oracle http_server 11.1.1.7.0 - - cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*
oracle http_server 11.1.1.9.0 - - cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:*
oracle http_server 12.1.3.0.0 - - cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:*
oracle http_server 12.2.1.1.0 - - cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:*
oracle http_server 12.2.1.2.0 - - cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:*
oracle integrated_lights_out_manager_firmware * - - cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*
debian debian_linux 7.0 - - cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
debian debian_linux 8.0 - - cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
redhat satellite 5.7 - - cpe:2.3:a:redhat:satellite:5.7:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 5.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 7.0 - - cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_eus 6.6 - - cpe:2.3:o:redhat:enterprise_linux_eus:6.6:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.1 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.2 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.3 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.4 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.5 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_eus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_server 5.0 - - cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0 - - cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 7.0 - - cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 6.6 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.3 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.4 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_aus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.3 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.6 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
redhat enterprise_linux_server_tus 7.7 - - cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 5.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 7.0 - - cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
suse linux_enterprise_debuginfo 11 - - cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*
opensuse opensuse 13.1 - - cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
opensuse opensuse 13.2 - - cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
suse linux_enterprise_desktop 11 - - cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
suse linux_enterprise_desktop 12 - - cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
suse linux_enterprise_server 10 - - cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:ltss:*:*:*
suse linux_enterprise_server 11 - - cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:*
suse linux_enterprise_server 12 - - cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*
suse linux_enterprise_software_development_kit 11 - - cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*
suse linux_enterprise_software_development_kit 12 - - cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:-:*:*:*:*:*:*
suse manager 1.7 - - cpe:2.3:a:suse:manager:1.7:*:*:*:*:*:*:*
canonical ubuntu_linux 12.04 - - cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
canonical ubuntu_linux 14.04 - - cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
canonical ubuntu_linux 15.04 - - cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
redhat satellite 5.6 - - cpe:2.3:a:redhat:satellite:5.6:*:*:*:*:*:*:*
fujitsu sparc_enterprise_m3000_firmware * - - cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:*
fujitsu sparc_enterprise_m4000_firmware * - - cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:*
fujitsu sparc_enterprise_m5000_firmware * - - cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:*
fujitsu sparc_enterprise_m8000_firmware * - - cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:*
fujitsu sparc_enterprise_m9000_firmware * - - cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:*
huawei e6000_firmware - - - cpe:2.3:o:huawei:e6000_firmware:-:*:*:*:*:*:*:*
huawei e9000_firmware - - - cpe:2.3:o:huawei:e9000_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_18500_firmware - - - cpe:2.3:o:huawei:oceanstor_18500_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_18800_firmware - - - cpe:2.3:o:huawei:oceanstor_18800_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_18800f_firmware - - - cpe:2.3:o:huawei:oceanstor_18800f_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_9000_firmware - - - cpe:2.3:o:huawei:oceanstor_9000_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_cse_firmware - - - cpe:2.3:o:huawei:oceanstor_cse_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_hvs85t_firmware - - - cpe:2.3:o:huawei:oceanstor_hvs85t_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_s2600t_firmware - - - cpe:2.3:o:huawei:oceanstor_s2600t_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_s5500t_firmware - - - cpe:2.3:o:huawei:oceanstor_s5500t_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_s5600t_firmware - - - cpe:2.3:o:huawei:oceanstor_s5600t_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_s5800t_firmware - - - cpe:2.3:o:huawei:oceanstor_s5800t_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_s6800t_firmware - - - cpe:2.3:o:huawei:oceanstor_s6800t_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_vis6600t_firmware - - - cpe:2.3:o:huawei:oceanstor_vis6600t_firmware:-:*:*:*:*:*:*:*
huawei quidway_s9300_firmware - - - cpe:2.3:o:huawei:quidway_s9300_firmware:-:*:*:*:*:*:*:*
huawei s7700_firmware - - - cpe:2.3:o:huawei:s7700_firmware:-:*:*:*:*:*:*:*
huawei 9700_firmware - - - cpe:2.3:o:huawei:9700_firmware:-:*:*:*:*:*:*:*
huawei s12700_firmware - - - cpe:2.3:o:huawei:s12700_firmware:-:*:*:*:*:*:*:*
huawei s2700_firmware - - - cpe:2.3:o:huawei:s2700_firmware:-:*:*:*:*:*:*:*
huawei s3700_firmware - - - cpe:2.3:o:huawei:s3700_firmware:-:*:*:*:*:*:*:*
huawei s5700ei_firmware - - - cpe:2.3:o:huawei:s5700ei_firmware:-:*:*:*:*:*:*:*
huawei s5700hi_firmware - - - cpe:2.3:o:huawei:s5700hi_firmware:-:*:*:*:*:*:*:*
huawei s5700si_firmware - - - cpe:2.3:o:huawei:s5700si_firmware:-:*:*:*:*:*:*:*
huawei s5710ei_firmware - - - cpe:2.3:o:huawei:s5710ei_firmware:-:*:*:*:*:*:*:*
huawei s5710hi_firmware - - - cpe:2.3:o:huawei:s5710hi_firmware:-:*:*:*:*:*:*:*
huawei s6700_firmware - - - cpe:2.3:o:huawei:s6700_firmware:-:*:*:*:*:*:*:*
huawei s2750_firmware - - - cpe:2.3:o:huawei:s2750_firmware:-:*:*:*:*:*:*:*
huawei s5700li_firmware - - - cpe:2.3:o:huawei:s5700li_firmware:-:*:*:*:*:*:*:*
huawei s5700s-li_firmware - - - cpe:2.3:o:huawei:s5700s-li_firmware:-:*:*:*:*:*:*:*
huawei s5720hi_firmware - - - cpe:2.3:o:huawei:s5720hi_firmware:-:*:*:*:*:*:*:*
huawei s5720ei_firmware - - - cpe:2.3:o:huawei:s5720ei_firmware:-:*:*:*:*:*:*:*
huawei te60_firmware - - - cpe:2.3:o:huawei:te60_firmware:-:*:*:*:*:*:*:*
huawei oceanstor_replicationdirector v100r003c00 - - cpe:2.3:a:huawei:oceanstor_replicationdirector:v100r003c00:*:*:*:*:*:*:*
huawei policy_center v100r003c00 - - cpe:2.3:a:huawei:policy_center:v100r003c00:*:*:*:*:*:*:*
huawei policy_center v100r003c10 - - cpe:2.3:a:huawei:policy_center:v100r003c10:*:*:*:*:*:*:*
huawei smc2.0 v100r002c01 - - cpe:2.3:a:huawei:smc2.0:v100r002c01:*:*:*:*:*:*:*
huawei smc2.0 v100r002c02 - - cpe:2.3:a:huawei:smc2.0:v100r002c02:*:*:*:*:*:*:*
huawei smc2.0 v100r002c03 - - cpe:2.3:a:huawei:smc2.0:v100r002c03:*:*:*:*:*:*:*
huawei smc2.0 v100r002c04 - - cpe:2.3:a:huawei:smc2.0:v100r002c04:*:*:*:*:*:*:*
huawei ultravr v100r003c00 - - cpe:2.3:a:huawei:ultravr:v100r003c00:*:*:*:*:*:*:*
ibm cognos_metrics_manager 10.1 - - cpe:2.3:a:ibm:cognos_metrics_manager:10.1:*:*:*:*:*:*:*
ibm cognos_metrics_manager 10.1.1 - - cpe:2.3:a:ibm:cognos_metrics_manager:10.1.1:*:*:*:*:*:*:*
ibm cognos_metrics_manager 10.2 - - cpe:2.3:a:ibm:cognos_metrics_manager:10.2:*:*:*:*:*:*:*
ibm cognos_metrics_manager 10.2.1 - - cpe:2.3:a:ibm:cognos_metrics_manager:10.2.1:*:*:*:*:*:*:*
ibm cognos_metrics_manager 10.2.2 - - cpe:2.3:a:ibm:cognos_metrics_manager:10.2.2:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
SSRT102127 vendor-advisory
cve.org
访问
RHSA-2015:1243 vendor-advisory
cve.org
访问
RHSA-2015:1007 vendor-advisory
cve.org
访问
HPSBGN03367 vendor-advisory
cve.org
访问
HPSBUX03512 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
RHSA-2015:1006 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
1033737 vdb-entry
cve.org
访问
SUSE-SU-2015:2192 vendor-advisory
cve.org
访问
HPSBGN03399 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
1036222 vdb-entry
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
GLSA-201512-10 vendor-advisory
cve.org
访问
RHSA-2015:1229 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
1032600 vdb-entry
cve.org
访问
1032910 vdb-entry
cve.org
访问
USN-2706-1 vendor-advisory
cve.org
访问
RHSA-2015:1526 vendor-advisory
cve.org
访问
SSRT102133 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
1032599 vdb-entry
cve.org
访问
HPSBMU03401 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
HPSBMU03345 vendor-advisory
cve.org
访问
1032734 vdb-entry
cve.org
访问
IV71892 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
1033769 vdb-entry
cve.org
访问
1032707 vdb-entry
cve.org
访问
openSUSE-SU-2015:1289 vendor-advisory
cve.org
访问
RHSA-2015:1091 vendor-advisory
cve.org
访问
HPSBGN03402 vendor-advisory
cve.org
访问
IV71888 vendor-advisory
cve.org
访问
RHSA-2015:1228 vendor-advisory
cve.org
访问
HPSBGN03405 vendor-advisory
cve.org
访问
1032708 vdb-entry
cve.org
访问
无标题 OTHER
cve.org
访问
DSA-3316 vendor-advisory
cve.org
访问
SUSE-SU-2015:2166 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
1033415 vdb-entry
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
HPSBGN03403 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
HPSBGN03407 vendor-advisory
cve.org
访问
1033432 vdb-entry
cve.org
访问
HPSBGN03354 vendor-advisory
cve.org
访问
SUSE-SU-2015:1138 vendor-advisory
cve.org
访问
1032858 vdb-entry
cve.org
访问
SSRT102073 vendor-advisory
cve.org
访问
1032788 vdb-entry
cve.org
访问
USN-2696-1 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
DSA-3339 vendor-advisory
cve.org
访问
RHSA-2015:1020 vendor-advisory
cve.org
访问
RHSA-2015:1242 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
SUSE-SU-2015:1086 vendor-advisory
cve.org
访问
1033431 vdb-entry
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
1032868 vdb-entry
cve.org
访问
HPSBGN03415 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
91787 vdb-entry
cve.org
访问
SUSE-SU-2015:1319 vendor-advisory
cve.org
访问
SUSE-SU-2015:1320 vendor-advisory
cve.org
访问
openSUSE-SU-2015:1288 vendor-advisory
cve.org
访问
RHSA-2015:1241 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
RHSA-2015:1230 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
HPSBGN03338 vendor-advisory
cve.org
访问
1033386 vdb-entry
cve.org
访问
HPSBMU03377 vendor-advisory
cve.org
访问
1033072 vdb-entry
cve.org
访问
无标题 OTHER
cve.org
访问
SUSE-SU-2015:1085 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
RHSA-2015:1021 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
SUSE-SU-2015:1073 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
SUSE-SU-2015:1161 vendor-advisory
cve.org
访问
HPSBGN03414 vendor-advisory
cve.org
访问
73684 vdb-entry
cve.org
访问
1032990 vdb-entry
cve.org
访问
1033071 vdb-entry
cve.org
访问
SUSE-SU-2016:0113 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
CVSS评分详情
5.0
MEDIUM
CVSS向量: AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS版本: 2.0
机密性
PARTIAL
完整性
NONE
可用性
NONE
时间信息
发布时间:
2015-04-01 00:00:00
修改时间:
2024-08-06 05:24:38
创建时间:
2025-11-11 15:34:01
更新时间:
2025-11-11 15:51:55
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2015-2808 2025-11-11 15:18:55 2025-11-11 07:34:01
NVD nvd_CVE-2015-2808 2025-11-11 14:54:49 2025-11-11 07:42:44
CNNVD cnnvd_CNNVD-201503-654 2025-11-11 15:09:33 2025-11-11 07:51:55
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:51:55
vulnerability_type: 未提取 → 加密问题; cnnvd_id: 未提取 → CNNVD-201503-654; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 加密问题
  • cnnvd_id: 未提取 -> CNNVD-201503-654
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:42:44
cvss_score: 未提取 → 5.0; cvss_vector: NOT_EXTRACTED → AV:N/AC:L/Au:N/C:P/I:N/A:N; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 101; references_count: 106 → 101; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • cvss_score: 未提取 -> 5.0
  • cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:P/I:N/A:N
  • cvss_version: NOT_EXTRACTED -> 2.0
  • affected_products_count: 0 -> 101
  • references_count: 106 -> 101
  • data_sources: ['cve'] -> ['cve', 'nvd']