CVE-2015-3230

389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html	Patch Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html
https://bugzilla.redhat.com/show_bug.cgi?id=1230996
https://fedorahosted.org/389/ticket/48194
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html	Patch Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html
https://bugzilla.redhat.com/show_bug.cgi?id=1230996
https://fedorahosted.org/389/ticket/48194

Configurations

Configuration 1 (hide)

cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:28

Type	Values Removed	Values Added
References	~~() http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html - Patch, Vendor Advisory~~	() http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html - Patch, Vendor Advisory
References	~~() http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html -~~	() http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html -
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=1230996 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=1230996 -
References	~~() https://fedorahosted.org/389/ticket/48194 -~~	() https://fedorahosted.org/389/ticket/48194 -

Information

Published : 2015-10-29 20:59

Updated : 2024-11-21 02:28

NVD link : CVE-2015-3230

Mitre link : CVE-2015-3230

CVE.ORG link : CVE-2015-3230

JSON object : View

Products Affected

fedoraproject

389_directory_server

CWE

CWE-254

7PK - Security Features

{"id": "CVE-2015-3230", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-10-29T20:59:00.087", "references": [{"url": "http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1230996", "source": "secalert@redhat.com"}, {"url": "https://fedorahosted.org/389/ticket/48194", "source": "secalert@redhat.com"}, {"url": "http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-3-12.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168985.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1230996", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://fedorahosted.org/389/ticket/48194", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-254"}]}], "descriptions": [{"lang": "en", "value": "389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher."}, {"lang": "es", "value": "389 Directory Server (anteriormente Fedora Directory Server) en versiones anteriores a 1.3.3.12 no hace cumplir la preferencia nsSSL3Ciphers cuando crean un sslSocket, lo que permite a atacantes remotos tener un impacto no especificado mediante la petici\u00f3n de utilizar un cifrado deshabilitado."}], "lastModified": "2024-11-21T02:28:57.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fedoraproject:389_directory_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D55DA2AE-B217-41DF-A14F-8282D1B3808D", "versionEndIncluding": "1.3.3.10"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}