IP ADDRESS NetBIOS Domain NetBIOS Name OS

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX
192.168.214.66 OBIEE AIX
192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX

192.168.214.66 OBIEE AIX
Vulnerability Port/Protocol Risk

Oracle TNS Poison Vulnerability 1521/TCP Remote Access

SSLv2 Enabled 7005/TCP Remote Access
SSLv3 Enabled 5989/TCP Remote Access
SSLv3 Enabled 7005/TCP Remote Access

Strong Bleichenbacher Oracle (ROBOT) 7005/TCP Remote Access

SSL Server Supports RC4 Ciphers for SSLv3 5989/TCP Exposure

RFC7525 Lack of SHA256 Exposure 5989/TCP Exposure

SSLv3 POODLE Attack 5989/TCP Exposure

SSL Server Supports RC4 Ciphers for TLSv1 5989/TCP Exposure

SSL Server Supports DES Ciphers (Sweet32 Exposure) 5989/TCP Exposure

SSL Server Supports RC4 Ciphers for SSLv2 7005/TCP Exposure

SSL Server Supports DES Ciphers (Sweet32 Exposure) 7005/TCP Exposure

SSLv3 POODLE Attack 7005/TCP Exposure

SSL Server Supports Diffie-Hellman Ephemeral Export Cipher

(Logjam Exposure) 7005/TCP Exposure
SSLv2 DROWN Attack Vulnerability 7005/TCP Exposure
CVSS V2 Rank CVE

7.5 High CVE-2012-1675, CVE-2012-1675, CVE-2012-1675

4 Medium
4 Medium
4 Medium

CVE-2012-5081, CVE-2016-6883, CVE-2017-1000385, CVE-2017-12373, CVE-2017-

13098, CVE-2017-13099, CVE-2017-17382, CVE-2017-17427, CVE-2017-17428, CVE-
5 Medium 2017-17841, CVE-2017-6168, CVE-2018-1388

4.3 Medium CVE-2013-2566

0 Medium

4.3 Medium CVE-2014-3566, CVE-2014-3566, CVE-2014-3566

4.3 Medium CVE-2013-2566, CVE-2015-2808

5 Medium CVE-2016-2183

4.3 Medium CVE-2013-2566

5 Medium CVE-2016-2183

4.3 Medium CVE-2014-3566, CVE-2014-3566, CVE-2014-3566

4.3 Medium CVE-2015-4000

4.3 Medium CVE-2016-0800
Description
Oracle TNS Listener is vulnerable to a man-in-the-middle attack due to the way remote listener registrations are handled. This
successful attack could compromise the confidentiality, integrity and availability of the target.
SSLv2 is enabled on this host. SSLv2 has been deprecated, and due to pervasive security flaws, is not recommended for use.
SSLv3 is enabled on this host. SSLv3 has been deprecated, and due to pervasive security flaws, is not recommended for use.
SSLv3 is enabled on this host. SSLv3 has been deprecated, and due to pervasive security flaws, is not recommended for use.

A vulnerability exists in the TLS stack as implemented by multiple vendors. The issue is that the scanned server behaves differe
payload in the Client Key Exchange. This can allow a remote unauthenticated attacker to gain access to perform cryptographic
used by this server.

The padding of an RSA encrypted TLS message looks like this:

00 02 || [random padding] || 00 || [[protocol version] || [random key]

A properly implemented TLS stack must not reveal whether the decrypted data matches the expected format. The remote TLS
improperly formatted Client Key Exchange payload before receiving remaining messages needed for a handshake. When recei
server waits for additional data from the client. This is described in detail in the TLS 1.2 standard in chapter 7.4.7.1. [2].

The oracle in this case is a strong oracle meaning that it is readily exploitable.
RC4 ciphers are vulnerable to bit-flipping attacks if they are not combined with strong Message Authentication Code(MAC). Ho
which attacks only blocks ciphers and not RC4 as it is a stream cipher.
RFC7525 Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) se
the SHA256 or greater hash algorithm.

An oracle padding attack has been described for SSLv3 when a cipher block chaining (CBC) mode ciphersuite is selected. In this
information such as authentication cookies without knowing the encryption key. This attack requires that the adversary can ex
requests between a targeted client and server. The attacker must also be able to modify SSL records in transit to the server. W
repeated requests and use the server s response to decrypt specific bytes in the HTTP headers. Successful exploitation can allo
RC4 ciphers are vulnerable to bit-flipping attacks if they are not combined with strong Message Authentication Code(MAC). Ho
which attacks only blocks ciphers and not RC4 as it is a stream cipher.
DES and Triple-DES are known to be vulnerable to Birthday attacks. One particular attack, known as Sweet32, demonstrates ho
attacking a TLS-secured HTTP session.
RC4 ciphers are vulnerable to bit-flipping attacks if they are not combined with strong Message Authentication Code(MAC). Ho
which attacks only blocks ciphers and not RC4 as it is a stream cipher.
DES and Triple-DES are known to be vulnerable to Birthday attacks. One particular attack, known as Sweet32, demonstrates ho
attacking a TLS-secured HTTP session.

An oracle padding attack has been described for SSLv3 when a cipher block chaining (CBC) mode ciphersuite is selected. In this
information such as authentication cookies without knowing the encryption key. This attack requires that the adversary can ex
requests between a targeted client and server. The attacker must also be able to modify SSL records in transit to the server. W
repeated requests and use the server s response to decrypt specific bytes in the HTTP headers. Successful exploitation can allo

The remote SSL service supports export grade ciphers using Diffie-Hellman ephemeral (DHE) key exchange. A flaw in the TLS D
to downgrade a secure connection to use a 512-bit Diffie-Hellman group. An attacker can leverage this behavior by performing
algorithm to prepare a discrete log oracle for the DH parameters used by the server. The discrete log oracle can then be used t
and expose protected communications. Successful exploitation by an active man-in-the-middle attacker requires that the clien
exchange.
A cryptographic attack can allow attackers to extract private key details from a server if it supports SSLv2 with export ciphers. T
recorded SSL/TLS sessions or intercept connections when the exposed key is used. Depending on the environment, this attack
computer. All services and protocols making use of the same key material are affected in the event of a successful attack.