CVE-2015-3152 : Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before

Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.

Published 2016-05-16 10:59:01

Updated 2022-08-29 20:05:18

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2015-3152

Debian » Debian Linux » Version: 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Desktop » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 7.3
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 7.4
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 7.5
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 7.7
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 7.1
cpe:2.3:o:redhat:enterprise_linux_eus:7.1:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Eus » Version: 7.2
cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Workstation » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.3
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.4
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Aus » Version: 7.7
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 7.3
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 7.6
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
Matching versions
Redhat » Enterprise Linux Server Tus » Version: 7.7
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 5.5.0 and before (<) 5.5.27
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 5.6.0 and before (<) 5.6.11
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
PHP » PHP
Versions from including (>=) 5.4.0 and before (<) 5.4.43
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql
Versions up to, including, (<=) 5.7.2
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Connector/c
Versions up to, including, (<=) 6.1.2
cpe:2.3:a:oracle:mysql_connector\/c:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 21
cpe:2.3:o:fedoraproject:fedora:21:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 22
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
Matching versions
Mariadb » Mariadb
Versions from including (>=) 10.0.0 and before (<) 10.0.20
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Matching versions
Mariadb » Mariadb
Versions from including (>=) 5.5.0 and before (<) 5.5.44
cpe:2.3:a:mariadb:mariadb:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2015-3152

Top countries where our scanners detected CVE-2015-3152

Top open port discovered on systems with this issue 80

IPs affected by CVE-2015-3152 724,728

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2015-3152!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2015-3152

EPSS FAQ

0.17%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 54 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-3152

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2015-3152

CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-3152

https://github.com/mysql/mysql-server/commit/3bd5589e1a5a93f9c224badf983cd65c45215390

WL#6791 : Redefine client --ssl option to imply enforced encryption · mysql/mysql-server@3bd5589 · GitHub
Patch;Third Party Advisory
http://packetstormsecurity.com/files/131688/MySQL-SSL-TLS-Downgrade.html

MySQL SSL / TLS Downgrade ≈ Packet Storm
Third Party Advisory;VDB Entry
http://rhn.redhat.com/errata/RHSA-2015-1647.html

RHSA-2015:1647 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://www.duosecurity.com/blog/backronym-mysql-vulnerability

The BACKRONYM MySQL Vulnerability | Duo Security
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161625.html

[SECURITY] Fedora 21 Update: mariadb-10.0.20-1.fc21
Mailing List;Third Party Advisory
http://www.securitytracker.com/id/1032216

MySQL '--ssl' Client Option Lets Remote Users Downgrade SSL/TLS Connections - SecurityTracker
Third Party Advisory;VDB Entry
http://www.debian.org/security/2015/dsa-3311

Debian -- Security Information -- DSA-3311-1 mariadb-10.0
Third Party Advisory

CVEs referencing this url
http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory/

SSL/TLS in 5.6 and 5.5 – oCERT Advisory | Todd's MySQL Blog
Third Party Advisory
http://www.securityfocus.com/archive/1/535397/100/1100/threaded

SecurityFocus
Third Party Advisory;VDB Entry
http://rhn.redhat.com/errata/RHSA-2015-1665.html

RHSA-2015:1665 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://jira.mariadb.org/browse/MDEV-7937

[MDEV-7937] Enforce SSL when --ssl client option is used - Jira
Issue Tracking;Vendor Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161436.html

[SECURITY] Fedora 22 Update: mariadb-10.0.20-1.fc22
Mailing List;Third Party Advisory
http://mysqlblog.fivefarmers.com/2014/04/02/redefining-ssl-option/

Redefining –ssl option | Todd's MySQL Blog
Exploit;Third Party Advisory
http://www.securityfocus.com/bid/74398

Oracle MySQL CVE-2015-3152 SSL Certificate Validation Security Bypass Vulnerability
Third Party Advisory;VDB Entry
http://www.ocert.org/advisories/ocert-2015-003.html

oCERT archive
Vendor Advisory
https://access.redhat.com/security/cve/cve-2015-3152

CVE-2015-3152 - Red Hat Customer Portal
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1646.html

RHSA-2015:1646 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url