CVE-2016-0270

CVE-2016-0270 describes a vulnerability in IBM Domino versions 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, as well as IBM Client Application Access and IBM Notes, when using TLS with AES GCM. The flaw stems from the use of random nonce generation, which can lead to nonce reuse within a session. This nonce reuse, combined with a "forbidden attack," allows remote attackers to potentially obtain the authentication key and spoof data. Rated with a CVSS v3 score of 5.9 (Medium), this vulnerability has a network attack vector and high attack complexity, requiring no user interaction. The primary impact is a high risk of confidentiality compromise, though integrity and availability are not directly affected. There is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered minimal community discussion and media coverage, suggesting low public awareness and attention.