CVE-2015-3197

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.1 before 1.0.1r OpenSSL versions 1.0.2 before 1.0.2f

Description The issue is related to errors in cryptographic transformations in the OpenSSL library, specifically in the ssl/s2 srvr.c function. This can be exploited by a remote attacker to compromise the cryptographic protection mechanism by performing computations on SSLv2 traffic, related to the get client master key and get client hello functions. The vulnerability makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms.

Recommendations For OpenSSL versions 1.0.1 before 1.0.1r, update to version 1.0.1r or later. For OpenSSL versions 1.0.2 before 1.0.2f, update to version 1.0.2f or later. As a temporary workaround, consider disabling the use of SSLv2 traffic until a patch is available. Restrict access to the get client master key and get client hello functions to minimize the risk of exploitation.