CVE-2013-2566

CVSS V2 Medium 4.3 CVSS V3 Medium 5.9
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
Overview
  • CVE ID
  • CVE-2013-2566
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2013-03-15T21:55:01
  • Last Modified Date
  • 2020-11-23T19:48:41
Weakness Enumerations
CWE URL
CWE-326 http://cwe.mitre.org/data/definitions/326.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:* 1 OR 3.0.0 3.9.1
cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* 1 OR 3.0.0 3.2.11
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:* 1 OR 4.0.0 4.0.4
AND
cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp_1121
cpe:2.3:h:fujitsu:sparc_enterprise_m3000:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp_1121
cpe:2.3:h:fujitsu:sparc_enterprise_m4000:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp_1121
cpe:2.3:h:fujitsu:sparc_enterprise_m5000:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp_1121
cpe:2.3:h:fujitsu:sparc_enterprise_m8000:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp_1121
cpe:2.3:h:fujitsu:sparc_enterprise_m9000:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp2280
cpe:2.3:h:fujitsu:m10-1:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp2280
cpe:2.3:h:fujitsu:m10-4:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:* 1 OR xcp xcp2280
cpe:2.3:h:fujitsu:m10-4s:-:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* 1 OR 25.0.1
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* 1 OR 17.0.11
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* 1 OR 24.1.0 24.1.1
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* 1 OR 2.22.1
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* 1 OR 24.1.1
cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:* 1 OR 17.0.11
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:P/I:N/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • HIGH
  • Privileges Required
  • NONE
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • NONE
  • Base Score
  • 5.9
  • Base Severity
  • MEDIUM
  • Exploitability Score
  • 2.2
  • Impact Score
  • 3.6
References
Reference URL Reference Tags
http://www.isg.rhul.ac.uk/tls/ Third Party Advisory
http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html Third Party Advisory
http://cr.yp.to/talks/2013.03.12/slides.pdf Third Party Advisory
http://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4 Third Party Advisory
http://www.opera.com/security/advisory/1046 Third Party Advisory
http://www.opera.com/docs/changelogs/unified/1215/ Third Party Advisory
http://www.mozilla.org/security/announce/2013/mfsa2013-103.html Third Party Advisory
http://www.ubuntu.com/usn/USN-2031-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2032-1 Third Party Advisory
http://security.gentoo.org/glsa/glsa-201406-19.xml Third Party Advisory
http://marc.info/?l=bugtraq&m=143039468003789&w=2 Issue Tracking Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935 Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html Third Party Advisory
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888 Third Party Advisory
http://www.securityfocus.com/bid/58796 Third Party Advisory VDB Entry
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 Third Party Advisory
https://security.gentoo.org/glsa/201504-01 Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2013-2566
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2566
History
Created Old Value New Value Data Type Notes
2022-05-10 16:19:09 Added to TrackCVE