Vulnerability Details : CVE-2013-2566
Public exploit exists!
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
Products affected by CVE-2013-2566
- cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:*
- Oracle » Integrated Lights Out Manager FirmwareVersions from including (>=) 3.0.0 and up to, including, (<=) 3.2.11cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*
- Oracle » Integrated Lights Out Manager FirmwareVersions from including (>=) 4.0.0 and up to, including, (<=) 4.0.4cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*
- Oracle » Communications Application Session ControllerVersions from including (>=) 3.0.0 and up to, including, (<=) 3.9.1cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-2566
0.56%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 78 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2013-2566
-
SSL/TLS Version Detection
Disclosure Date: 2014-10-14First seen: 2022-12-23auxiliary/scanner/ssl/ssl_versionCheck if a server supports a given version of SSL/TLS and cipher suites. The certificate is stored in loot, and any known vulnerabilities against that SSL version and cipher suite combination are checked. These checks include POODLE, deprecated protocols, expired/no
CVSS scores for CVE-2013-2566
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2013-2566
-
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-2566
-
http://www.ubuntu.com/usn/USN-2031-1
USN-2031-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://cr.yp.to/talks/2013.03.12/slides.pdf
Third Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
cpuapr2016v3Third Party Advisory
-
http://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4
The Opera Blog - News | OperaThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Oracle Critical Patch Update - January 2018Third Party Advisory
-
http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html
Attack of the week: RC4 is kind of broken in TLS – A Few Thoughts on Cryptographic EngineeringThird Party Advisory
-
http://marc.info/?l=bugtraq&m=143039468003789&w=2
'[security bulletin] HPSBGN03324 rev.1 - HP Business Service Automation Essentials Core, Remote Discl' - MARCIssue Tracking;Third Party Advisory
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Juniper Networks - 2015-10 Security Bulletin: CTPView: Multiple Vulnerabilities in CTPViewThird Party Advisory
-
http://www.isg.rhul.ac.uk/tls/
On the Security of RC4 in TLSThird Party Advisory
-
http://www.securityfocus.com/bid/58796
SSL/TLS RC4 CVE-2013-2566 Information Disclosure WeaknessThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Oracle Critical Patch Update - October 2017Third Party Advisory
-
https://security.gentoo.org/glsa/201504-01
Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo securityThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Oracle Critical Patch Update - July 2016Third Party Advisory
-
http://security.gentoo.org/glsa/glsa-201406-19.xml
Mozilla Network Security Service: Multiple vulnerabilities (GLSA 201406-19) — Gentoo securityThird Party Advisory
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
Oracle Critical Patch Update - October 2016Third Party Advisory
-
http://www.opera.com/security/advisory/1046
Welcome - Opera Security CornerThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2032-1
USN-2032-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.mozilla.org/security/announce/2013/mfsa2013-103.html
Miscellaneous Network Security Services (NSS) vulnerabilities — MozillaThird Party Advisory
-
http://www.opera.com/docs/changelogs/unified/1215/
How can we help you? - Opera HelpThird Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935
HPSBHF03654 rev.1 - HPE iMC PLAT Network Products using SSL/TLS, Multiple Remote VulnerabilitiesThird Party Advisory
-
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888
HPSBHF03673 rev.1 - HPE Comware 5 and Comware 7 Network Products using SSL/TLS, Multiple Remote VulnerabilitiesThird Party Advisory
Jump to