Unscored severity · published Mar 25, 2015
CVE-2015-0138
GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before…
–
CVSS
2.8%
EPSS
No
On KEV
Description
GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TD
Tivoli Directory Server · Ibm
through 6.0.0.73; 6.1.0; 6.1.0.0; 6.1.0.1; 6.1.0.2; 6.1.0.3; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0138
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00013.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00014.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00015.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00022.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00031.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1006.html
More from Tivoli Directory Server
7.8
CVE-2015-1975
The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, and 6.3 before iFix 37 and IBM Security Directory…
7.5
CVE-2015-1977
Directory traversal vulnerability in the Web Administration tool in IBM Tivoli Directory Server (ITDS) before 6.1.0.74-ISS-ISDS-IF0074, 6.2.x before 6.2.0.50-ISS-ISDS-IF0050, and…
5.5
CVE-2015-1976
IBM Security Directory Server could allow an authenticated user to execute commands into the web administration tool that would cause the tool to crash
–
CVE-2015-2019
IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent…
–
CVE-2015-1978
Cross-site scripting (XSS) vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix…