CVE-2013-2566: canonical ubuntu_linux Inadequate Encryption Strength
Vulnerability summary
CVE-2013-2566 is a medium (CVSS 5.9) Inadequate Encryption Strength vulnerability in canonical ubuntu_linux. EPSS estimates a 84.42% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 14-03-2013PublishedVulnerability first disclosed.
- 22-05-2026Last modifiedVulnerability information updated.
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
84.42%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 84.42% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSSL/TLS Version Detection
auxiliary/scanner/ssl/ssl_version
Maturity: poc
Weaknesses
CWE · root cause- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- CWE-327Use of a Broken or Risky Cryptographic AlgorithmThe product uses a broken or risky cryptographic algorithm or protocol.
Affected systems
Fujitsu8 products
- m10-1_firmware≥ xcp, < xcp2280
- m10-4_firmware≥ xcp, < xcp2280
- m10-4s_firmware≥ xcp, < xcp2280
- sparc_enterprise_m3000_firmware≥ xcp, < xcp_1121
- sparc_enterprise_m4000_firmware≥ xcp, < xcp_1121
Mozilla4 products
- firefox< 17.0.11 | < 25.0.1 | ≥ 24.1.0, < 24.1.1
- seamonkey< 2.22.1
- thunderbird< 24.1.1
- thunderbird_esr< 17.0.11
Oracle3 products
- communications_application_session_controller≥ 3.0.0, ≤ 3.9.1
- http_server11.1.1.7.0 | 11.1.1.9.0 | 12.1.3.0.0 | 12.2.1.1.0 | 12.2.1.2.0
- integrated_lights_out_manager_firmware≥ 3.0.0, ≤ 3.2.11 | ≥ 4.0.0, ≤ 4.0.4
Canonical1 product
- ubuntu_linuxEOL12.04 | 12.10 | 13.04 | 13.10
4 vendors · 16 products
References
21 links- www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlX Refsource CONFIRMThird Party Advisory
- blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.htmlX Refsource MISCThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlX Refsource CONFIRMThird Party Advisory
- marc.info?l=bugtraq&m=143039468003789&w=2Vendor AdvisoryX Refsource HPIssue TrackingThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlX Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlX Refsource CONFIRMThird Party Advisory
Show all 21 references
- my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4X Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlX Refsource CONFIRMThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05336888X Refsource CONFIRMThird Party Advisory
- h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05289935X Refsource CONFIRMThird Party Advisory