NVD

Id
20056  
Name
CVE-2016-4379  
Description
The TLS implementation in HPE Integrated Lights-Out 3 (aka iLO3) firmware before 1.88 does not properly use a MAC protection mechanism in conjunction with CBC padding, which allows remote attackers to obtain sensitive information via a padding-oracle attack, aka a Vaudenay attack.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-09-08  
Modified Date
2016-11-28  
Seq
2016-4379  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
109438 20056 CVE-2016-4379 92696  View
109439 20056 CVE-2016-4379 1036707  View
109440 20056 CVE-2016-4379 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05249760  View
109441 20056 CVE-2016-4379 https://www.iacr.org/archive/eurocrypt2002/23320530/cbc02_e02d.pdf  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
3802 JVNDB-2016-004575 HPE Integrated Lights-Out 3 ファームウェアの TLS の実装における重要な情報を取得される脆弱性 HPE Integrated Lights-Out 3 (別名 iLO3) ファームウェアの TLS の実装は、CBC パディングに関連した MAC 保護メカニズムを適切に使用しないため、重要な情報を取得される脆弱性が存在します。 CVE-2016-4379 90885 CVE-2016-4379 20056 4.3 3.7 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-004575.html 2016-08-30 2016-09-12 View