NVD Vulnerability Detail

CVE-2015-2318

Summary	The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.
Publication Date	Jan. 9, 2018, 4:29 a.m.
Registration Date	Jan. 26, 2021, 2:47 p.m.
Last Update	Nov. 21, 2024, 11:27 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:mono-project:mono::::::::					3.12.1

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:6.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/	Vendor Advisory
2	http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/	Vendor Advisory
3	http://www.openwall.com/lists/oss-security/2015/03/17/9	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2015/03/17/9	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/73253	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/73253	Third Party Advisory VDB Entry
7	http://www.ubuntu.com/usn/USN-2547-1	Third Party Advisory
8	http://www.ubuntu.com/usn/USN-2547-1	Third Party Advisory
9	https://bugzilla.redhat.com/show_bug.cgi?id=1202869	Issue Tracking Third Party Advisory
10	https://bugzilla.redhat.com/show_bug.cgi?id=1202869	Issue Tracking Third Party Advisory
11	https://github.com/mono/mono/commit/1509226c41d74194c146deb173e752b8d3cdeec4	Third Party Advisory
12	https://github.com/mono/mono/commit/1509226c41d74194c146deb173e752b8d3cdeec4	Third Party Advisory
13	https://mitls.org/pages/attacks/SMACK#skip	Third Party Advisory
14	https://mitls.org/pages/attacks/SMACK#skip	Third Party Advisory
15	https://www.debian.org/security/2015/dsa-3202	Third Party Advisory
16	https://www.debian.org/security/2015/dsa-3202	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-295	不正な証明書検証	https://cwe.mitre.org/data/definitions/295.html

JVN Vulnerability Information

Mono における証明書検証に関する脆弱性

Title	Mono における証明書検証に関する脆弱性
Summary	Mono には、証明書検証に関する脆弱性が存在します。本脆弱性は、"SMACK SKIP-TLS" の問題と呼ばれています。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 7, 2015, midnight
Registration Date	Feb. 13, 2018, 4:01 p.m.
Last Update	Feb. 13, 2018, 4:01 p.m.

Affected System

Debian

Debian GNU/Linux 6.0

Mono Project

Mono 3.12.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-2318	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2318
National Vulnerability Database (NVD)
2	CVE-2015-2318	https://nvd.nist.gov/vuln/detail/CVE-2015-2318

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-295	https://cwe.mitre.org/data/definitions/295.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3202	https://www.debian.org/security/2015/dsa-3202
GitHub
2	TLS protocol: add handshake state validation	https://github.com/mono/mono/commit/1509226c41d74194c146deb173e752b8d3cdeec4
Mono Project
3	TLS Vulnerabilities	http://www.mono-project.com/news/2015/03/07/mono-tls-vulnerability/
Red Hat Bugzilla
4	Bug 1202869	https://bugzilla.redhat.com/show_bug.cgi?id=1202869

Change Log

No	Changed Details	Date of change
0	[2018年02月13日] 掲載	Feb. 17, 2018, 10:37 a.m.