CVE-2015-0533

High

Published: 20/08/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

EMC RSA BSAFE Micro Edition Suite (MES) versions 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C version 2.8.9 and earlier allow remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks, leading to a loss of forward secrecy.

Risk Assessment

Attackers can lower the security level of communications, exposing the organization to the risk of sensitive data interception.

Recommendation

It is recommended to update to the latest versions of EMC RSA BSAFE Micro Edition Suite and RSA BSAFE SSL-C to mitigate the risks associated with this vulnerability.

Other vulnerabilities in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x, 4.1.x; RSA BSAFE SSL-C 2.8.9 i wcześniejsze

CVE-2015-0535High
EMC RSA BSAFE Micro Edition Suite (MES) versions 4.0.x before 4.0.8 and 4.1.x before 4.1.3, as well as RSA BSAFE SSL-C version 2.8.9 and earlier, do not properly restrict TLS state transitions. This allows remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the 'FREAK' issue.

Original NVD description (English source)

EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier allow remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message, a similar issue to CVE-2014-3572.