Strix
26.1K

CVE-2016-2183

HIGHCVSS 7.5/10EPSS 95.71%

Last modified

CVE-2016-2183 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.. EPSS estimates a 95.71% chance of exploitation in the next 30 days.

Description

The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
95.71%

99.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
RedhatJboss Enterprise Application Platform6.0.0
RedhatJboss Enterprise Web Server1.0.0
RedhatJboss Enterprise Web Server2.0.0
RedhatJboss Web Server3.0
RedhatEnterprise Linux5.0
RedhatEnterprise Linux6.0
RedhatEnterprise Linux7.0
PythonPython>= 2.7.0, < 2.7.13
PythonPython>= 3.4.0, < 3.4.7
PythonPython>= 3.5.0, < 3.5.3
CiscoContent Security Management Appliance9.6.6-068
CiscoContent Security Management Appliance9.7.0-006
OpensslOpenssl1.0.1a
OpensslOpenssl1.0.1b
OpensslOpenssl1.0.1c
OpensslOpenssl1.0.1d
OpensslOpenssl1.0.1e
OpensslOpenssl1.0.1f
OpensslOpenssl1.0.1g
OpensslOpenssl1.0.1h
OpensslOpenssl1.0.1i
OpensslOpenssl1.0.1j
OpensslOpenssl1.0.1k
OpensslOpenssl1.0.1l
OpensslOpenssl1.0.1m
OpensslOpenssl1.0.1n
OpensslOpenssl1.0.1o
OpensslOpenssl1.0.1p
OpensslOpenssl1.0.1q
OpensslOpenssl1.0.1r
OpensslOpenssl1.0.1t
OpensslOpenssl1.0.2a
OpensslOpenssl1.0.2b
OpensslOpenssl1.0.2c
OpensslOpenssl1.0.2d
OpensslOpenssl1.0.2e
OpensslOpenssl1.0.2f
OpensslOpenssl1.0.2h
OracleDatabase11.2.0.4
OracleDatabase12.1.0.2
NodejsNode.Js>= 0.10.0, < 0.10.47
NodejsNode.Js>= 0.12.0, < 0.12.16
NodejsNode.Js>= 4.0.0, < 4.1.2
NodejsNode.Js>= 4.2.0, < 4.6.0
NodejsNode.Js>= 6.0.0, < 6.7.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2016-2183?
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
How severe is CVE-2016-2183?
CVE-2016-2183 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 95.71% probability of exploitation in the next 30 days.
How do I fix CVE-2016-2183?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-2183?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST