CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2013-2566
Medium (5.9). EPSS 84% chance of exploitation in the next 30 days.
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
Severity
- EPSS
- 84% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-326, CWE-327
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- fujitsu:m10-1_firmware
- fujitsu:m10-4_firmware
- fujitsu:m10-4s_firmware
- fujitsu:sparc_enterprise_m3000_firmware
- fujitsu:sparc_enterprise_m4000_firmware
- fujitsu:sparc_enterprise_m5000_firmware
- fujitsu:sparc_enterprise_m8000_firmware
- fujitsu:sparc_enterprise_m9000_firmware
- mozilla:firefox
- mozilla:seamonkey
- mozilla:thunderbird
- mozilla:thunderbird_esr
- oracle:communications_application_session_controller
- oracle:http_server
- oracle:integrated_lights_out_manager_firmware
References
- http://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html
- http://cr.yp.to/talks/2013.03.12/slides.pdf
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://marc.info/?l=bugtraq&m=143039468003789&w=2
- http://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4