Published: 06/03/2015 Updated: 07/04/2021

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Schannel (aka Secure Channel) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly restrict TLS state transitions, which makes it easier for remote malicious users to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204 and CVE-2015-1067.

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows rt -
microsoft windows rt 8.1 -
microsoft windows 8.1 -
microsoft windows 8 -
microsoft windows server 2012 r2
microsoft windows server 2008 r2
microsoft windows 7 -
microsoft windows vista -
microsoft windows server 2003 -
microsoft windows server 2012 -
microsoft windows server 2008 -

FREAKing hell: ALL Windows versions vulnerable to SSL snoop

The Register • Darren Pauli • 06 Mar 2015

Relax! We've got a (server-knackering) workaround to sort things out, says Microsoft

Microsoft has confirmed that its implementation of SSL/TLS in all versions of Windows is vulnerable to the FREAK encryption-downgrade attack. This means if you're using the company's Windows operating system, an attacker on your network can potentially force Internet Explorer and other software using the Windows Secure Channel component to deploy weak encryption over the web. Intercepted HTTPS connections can be easily cracked, revealing sensitive details such as login cookies and banking inform...

CVE-2015-1637

Vulnerability Summary

Vulnerability Trend

Recent Articles

References

Vulmon Search

About

Products

Connect