CVE - CVE-2015-4000

CVE-ID
CVE-2015-4000	Learn more at National Vulnerability Database (NVD) • Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings
Description
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MLIST:[oss-security] 20150520 CVE-2015-4000 - TLS does not properly convey server's ciphersuite choice URL:http://openwall.com/lists/oss-security/2015/05/20/8 MISC:https://weakdh.org/ MISC:https://weakdh.org/imperfect-forward-secrecy.pdf MISC:https://blog.cloudflare.com/logjam-the-latest-tls-vulnerability-explained/ CONFIRM:https://www.openssl.org/blog/blog/2015/05/20/logjam-freak-upcoming-changes/ CONFIRM:https://www.suse.com/security/cve/CVE-2015-4000.html CONFIRM:https://www.openssl.org/news/secadv_20150611.txt CONFIRM:http://support.apple.com/kb/HT204941 CONFIRM:http://support.apple.com/kb/HT204942 CONFIRM:http://www.mozilla.org/security/announce/2015/mfsa2015-70.html CONFIRM:https://bugzilla.mozilla.org/show_bug.cgi?id=1138554 CONFIRM:https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes CONFIRM:http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html APPLE:APPLE-SA-2015-06-30-1 URL:http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html APPLE:APPLE-SA-2015-06-30-2 URL:http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html BID:74733 URL:http://www.securityfocus.com/bid/74733
Date Entry Created
20150515	Disclaimer: The entry creation date may reflect when the CVE-ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20150515)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an entry on the CVE list, which standardizes names for security problems.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: cve@mitre.org

Jul	AUG	Sep
	11
2014	2015	2016

Common Vulnerabilities and Exposures

CVE-2015-4000