JVN Info.

Id
18404  
Name
JVNDB-2014-007279  
Title
IBM Security Access Manager for Mobile および Security Access Manager for Web における重要な情報を取得される脆弱性  
Summary
IBM Security Access Manager for Mobile および Security Access Manager for Web には、重要な情報を取得される脆弱性が存在します。  
Nvdinfo
CVE-2014-6087  
Cvssv2
5  
Jvnurl
http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007279.html  
Published Date
2014-12-12  
Registered Date
2014-12-19  
Last Updated Date
2014-12-19  

Actions

Related Nessuslogs

Id Log ID Jvninfo Id Plugin ID CVE CVSS Risk Host Protocol Port Name Synopsis Description Solution See Also Plugin Output Actions
18930 H28-MOJ-Teikyo-Nara-17-seg-1-20161128-w510.csv 18404 91572 CVE-2016-2107 2.6 Low 172.30.201.61 tcp 443 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
20362 H28-MOJ-Teikyo-Nara-17-seg-2-20161128-w510.csv 18404 91572 CVE-2016-2107 2.6 Low 172.30.201.65 tcp 9855 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
20828 H28-MOJ-Teikyo-Nara-17-seg-2-20161128-w510.csv 18404 91572 CVE-2016-2107 2.6 Low 172.30.201.69 tcp 636 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
43374 H28-MOJ-Teikyo-Yokohama-18-seg-01-21161121-abe_ubh1mj.csv 18404 91572 CVE-2016-2107 2.6 Low 172.30.138.65 tcp 9855 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
43912 H28-MOJ-Teikyo-Yokohama-18-seg-01-21161121-abe_ubh1mj.csv 18404 91572 CVE-2016-2107 2.6 Low 172.30.138.69 tcp 636 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
45562 H28-MOJ-Teikyo-Yokohama-18-seg-02-21161121-abe_vilnov.csv 18404 91572 CVE-2016-2107 2.6 Low 172.30.138.61 tcp 443 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
52968 H28_MUN_DWEB_Q4_192_168_242_Part1.csv 18404 91572 CVE-2016-2107 2.6 Low 192.168.242.250 tcp 14943 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
54490 1_Tokyu_remi_20170126.csv 18404 91572 CVE-2016-2107 2.6 Low 54.199.215.149 tcp 443 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.
54531 2_tokyu_kosugi-square_20170118.csv 18404 91572 CVE-2016-2107 2.6 Low 202.53.27.201 tcp 443 OpenSSL AES-NI Padding Oracle MitM Information Disclosure It was possible to obtain sensitive information from the remote host with TLS-enabled services. The remote host is affected by a man-in-the-middle (MitM) information disclosure vulnerability due to an error in the implementation of ciphersuites that use AES in CBC mode with HMAC-SHA1 or HMAC-SHA256. The implementation is specially written to use the AES acceleration available in x86/amd64 processors (AES-NI). The error messages returned by the server allow allow a man-in-the-middle attacker to conduct a padding oracle attack, resulting in the ability to decrypt network traffic. Upgrade to OpenSSL version 1.0.1t / 1.0.2h or later. https://blog.filippo.io/luckyminus20/ http://www.nessus.org/u?37b909b6 https://www.openssl.org/news/secadv/20160503.txt Nessus was able to trigger a RECORD_OVERFLOW alert in the remote service by sending a crafted SSL "Finished" message.