CVE-2016-0704 in Integrated Lights Out Manager

Summary

An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorrect MASTER-KEY bytes during use of export cipher suites, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, a related issue to CVE-2016-0800.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Reservation

12/16/2015

Disclosure

03/02/2016

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
112145	Oracle Integrated Lights Out Manager System Management information disclosure	200	Not defined	Official fix	CVE-2016-0704
81139	OpenSSL SSLv2 s2_srvr.c get_client_master_key information disclosure	200	Unproven	Official fix	CVE-2016-0704

Sources

• MITRE
• NVD
• CVE Details