Home / Security / Advisories / NTAP-20180626-0002

NTAP-20180626-0002 — CVE-2015-8960 TLS Vulnerability in NetApp Products

Published 2018-06-26 · Updated 2021-03-16 · Status: Final · Exploitation: Public · Severity: HIGH 8.1 · ONTAP affected: Yes

Official advisory: NTAP-20180626-0002 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: ONTAP · Other NetApp products · SolidFire / NetApp HCI · OnCommand family · SnapCenter · SnapManager / Snap utilities | ONTAP-relevant | highest CVSS: 8.1

CVEs in this advisory

CVE-2015-8960 — HIGH · CVSS 8.1 · site index

What the CVE records say

CVE-2015-8960 — The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.

Impact

Successful exploitation of this vulnerability could result in information disclosure, unauthorized reading or modification of data or Denial of Service (DoS).

Affected products

Clustered Data ONTAP Antivirus Connector
Data ONTAP Edge
NetApp Host Agent
NetApp Plug-in for Symantec NetBackup
NetApp SMI-S Provider
NetApp SolidFire & HCI Management Node
OnCommand Shift
Snap Creator Framework
SnapDrive for Unix
SnapDrive for Windows
SnapManager for Oracle
SnapManager for SAP

Official fixes

SnapManager for Oracle — vendor fix ↗
SnapManager for Oracle — vendor fix ↗
SnapManager for SAP — vendor fix ↗
SnapManager for SAP — vendor fix ↗
SnapDrive for Unix — vendor fix ↗
SnapDrive for Windows — vendor fix ↗
NetApp SMI-S Provider — vendor fix ↗
NetApp SolidFire & HCI Management Node — vendor fix ↗
NetApp SolidFire & HCI Management Node — vendor fix ↗
Snap Creator Framework — vendor fix ↗
Clustered Data ONTAP Antivirus Connector — vendor fix ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.