CVE-2015-4078 - OpenCVE

Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:M/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Cloudera	Cloudera Manager Navigator

Configuration 1 [-]

OR	cpe:2.3:a:cloudera:cloudera_manager:5.3.0:::::::*
	cpe:2.3:a:cloudera:cloudera_manager:5.3.1:::::::*
	cpe:2.3:a:cloudera:cloudera_manager:5.3.2:::::::*
	cpe:2.3:a:cloudera:cloudera_manager:5.3.3:::::::*
	cpe:2.3:a:cloudera:cloudera_manager:5.4.0:::::::*
	cpe:2.3:a:cloudera:cloudera_manager:5.4.1:::::::*
	cpe:2.3:a:cloudera:navigator:2.2.0:::::::*
	cpe:2.3:a:cloudera:navigator:2.2.1:::::::*
	cpe:2.3:a:cloudera:navigator:2.2.2:::::::*
	cpe:2.3:a:cloudera:navigator:2.2.3:::::::*
	cpe:2.3:a:cloudera:navigator:2.3.0:::::::*
	cpe:2.3:a:cloudera:navigator:2.3.1:::::::*

References

Link	Resource
https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_o1q_wrm_js	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: mitre

Published: 2017-03-23T20:00:00

Updated: 2017-03-23T19:57:01

Reserved: 2015-05-22T00:00:00

Link: CVE-2015-4078

JSON object: View

NVD Information

Status : Analyzed

Published: 2017-03-23T20:59:00.327

Modified: 2017-03-28T18:32:13.400

Link: CVE-2015-4078

JSON object: View

Redhat Information

No data.

CWE

CWE-200

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cloudera:cloudera_manager:5.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "91B584EF-1E03-4D8E-986B-5DF9FB8F0E27", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:cloudera_manager:5.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "924D38B1-7622-4157-B855-A24563DE16BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:cloudera_manager:5.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "6EDA954F-E608-448F-AE72-27158423ED19", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:cloudera_manager:5.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "6F0C4825-0309-4B1F-BD4D-12798981FFB9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:cloudera_manager:5.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "C18B2BF0-CC58-470C-B33B-AE89B99DC891", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:cloudera_manager:5.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "3FF2E4C3-FFF3-4B12-A691-D88F96575A3F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:navigator:2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "A79F9C99-93A6-4D85-95A0-40605B190B17", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:navigator:2.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "AD0786C9-DDE6-4795-833D-8F489AC28F59", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:navigator:2.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "9D20C7A9-FAEB-49D5-AA29-E8AD81999AD4", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:navigator:2.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "75943073-7BB8-4C93-8AA4-49A9D808B9BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:navigator:2.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "92CA0B5E-CA21-4507-B4FB-7E9C638FCDFB", "vulnerable": true}, {"criteria": "cpe:2.3:a:cloudera:navigator:2.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "7041BC50-9CF1-4D02-9311-EFB0A76C878A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cloudera Navigator 2.2.x before 2.2.4 and 2.3.x before 2.3.3 include support for SSLv3 when configured to use SSL/TLS, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE)."}, {"lang": "es", "value": "Cloudera Navigator 2.2.x en versiones anteriores a 2.2.4 y 2.3.x en versiones anteriores a 2.3.3 incluyen soporte para SSLv3 cuando est\u00e1 configurado para utilizar SSL/TLS, lo que hace m\u00e1s f\u00e1cil a atacantes man-in-the-middle obtener datos en texto claro a trav\u00e9s de un ataque padding-oracle, una variante de CVE-2014-3566 (tambi\u00e9n conocido como POODLE)."}], "id": "CVE-2015-4078", "lastModified": "2017-03-28T18:32:13.400", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-03-23T20:59:00.327", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html#concept_o1q_wrm_js"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}