CVE-2015-0535

High

Published: 20/08/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

EMC RSA BSAFE Micro Edition Suite (MES) versions 4.0.x before 4.0.8 and 4.1.x before 4.1.3, as well as RSA BSAFE SSL-C version 2.8.9 and earlier, do not properly restrict TLS state transitions. This allows remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the 'FREAK' issue.

Risk Assessment

Organizations may be exposed to attacks that downgrade encryption security, potentially leading to data compromise. Attackers could exploit this vulnerability to intercept and decrypt sensitive information.

Recommendation

It is recommended to upgrade to version 4.0.8 or 4.1.3 for EMC RSA BSAFE Micro Edition Suite and to version 2.8.9 or later for RSA BSAFE SSL-C to mitigate this vulnerability.

Other vulnerabilities in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x, 4.1.x; RSA BSAFE SSL-C 2.8.9 i wcześniejsze

CVE-2015-0533High
EMC RSA BSAFE Micro Edition Suite (MES) versions 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C version 2.8.9 and earlier allow remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks, leading to a loss of forward secrecy.

Original NVD description (English source)

EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3 and RSA BSAFE SSL-C 2.8.9 and earlier do not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a similar issue to CVE-2015-0204.