WaratekVRT Sign in

CVE-2015-8960

Affected software13 products, listed below
Severity8.1 High CVSS 3.1 2 scores
WeaknessCWE-295
Published21 Sep 2016
Updated17 Jun 2026

Description

The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 10 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 1.9% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review automated Upstream data
  • Record active
Decided by The only affected product being a sealed appliance image, where Java runs but no -javaagent can be attached
Finding This CVE names only products the Waratek agent cannot be installed into (netapp/oncommand_shift, netapp/plug-in_for_symantec_netbackup, netapp/snapmanager, netapp/solidfire_\&_hci_management_node). They ship as sealed appliance images or as native code with no application JVM, so there is no start-up line to add -javaagent to. The vulnerability may well be a Java one; it is permanently out of ARMR's reach rather than outside its subject.

CVSS

8.1 HIGH v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.1 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 2.0 6.8 none AV:N/AC:M/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Products and versions

13 products, 13 version entries
SourceVendorProductSchemeAffected versions
nvd ietf transport layer security generic ≤ 1.2
nvd netapp clustered data ontap antivirus connector generic any version
nvd netapp data ontap edge generic any version
nvd netapp host agent generic any version
nvd netapp oncommand shift generic any version
nvd netapp plug-in for symantec netbackup generic any version
nvd netapp smi-s provider generic any version
nvd netapp snap creator framework generic any version
nvd netapp snapdrive generic any version
nvd netapp snapmanager generic any version
nvd netapp snapprotect generic any version
nvd netapp solidfire \& hci management node generic any version
nvd netapp system setup generic any version

References

URLTags
http://twitter.com/matthew_d_green/statuses/630908726950674433 Press/Media Coverage, Technical Description, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/20/4 Mailing List, Technical Description, Third Party Advisory
http://www.securityfocus.com/bid/93071 Broken Link, Third Party Advisory, VDB Entry
https://kcitls.org Exploit, Technical Description
https://security.netapp.com/advisory/ntap-20180626-0002/ Third Party Advisory
https://www.usenix.org/system/files/conference/woot15/woot15-paper-hlauschek.pdf Exploit, Mitigation, Technical Description

Timeline
Published2016-09-21By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.