NVD

Id
25068  
Name
CVE-2015-3152  
Description
Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, aka a "BACKRONYM" attack.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2016-05-16  
Modified Date
2016-11-29  
Seq
2015-3152  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
132322 25068 CVE-2015-3152 FEDORA-2015-10849  View
132323 25068 CVE-2015-3152 FEDORA-2015-10831  View
132324 25068 CVE-2015-3152 http://mysqlblog.fivefarmers.com/2014/04/02/redefining-ssl-option/  View
132325 25068 CVE-2015-3152 http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory/  View
132326 25068 CVE-2015-3152 http://packetstormsecurity.com/files/131688/MySQL-SSL-TLS-Downgrade.html  View
132327 25068 CVE-2015-3152 http://www.ocert.org/advisories/ocert-2015-003.html  View
132328 25068 CVE-2015-3152 20150429 [oCERT-2015-003] MySQL SSL/TLS downgrade  View
132329 25068 CVE-2015-3152 74398  View
132330 25068 CVE-2015-3152 1032216  View
132331 25068 CVE-2015-3152 https://access.redhat.com/security/cve/cve-2015-3152  View
132332 25068 CVE-2015-3152 https://github.com/mysql/mysql-server/commit/3bd5589e1a5a93f9c224badf983cd65c45215390  View
132333 25068 CVE-2015-3152 https://jira.mariadb.org/browse/MDEV-7937  View
132334 25068 CVE-2015-3152 https://www.duosecurity.com/blog/backronym-mysql-vulnerability  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11847 JVNDB-2015-007167 Oracle MySQL および MariaDB におけるサーバになりすまされる脆弱性 Oracle MySQL、Oracle MySQL Connector/C (別名 libmysqlclient)、および MariaDB は、SSL が任意であることを意味する --ssl オプションを使用するため、サーバになりすまされる脆弱性が存在します。 CVE-2015-3152 80377 CVE-2015-3152 25068 4.3 5.9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-007167.html 2015-06-09 2016-05-19 View