Published: 11/11/2021 Updated: 23/04/2024

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 446

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.

Vulnerable Product	Search on Vulmon	Subscribe to Product
balasys dheater -
siemens scalance_w1750d_firmware
suse linux enterprise server 15
suse linux enterprise server 11
suse linux enterprise server 12
f5 big-iq centralized management 7.1.0
f5 traffix signaling delivery controller 5.2.0
f5 traffix signaling delivery controller 5.1.0
f5 big-iq centralized management
f5 big-ip service proxy 1.6.0
f5 big-ip access policy manager
f5 big-ip advanced firewall manager
f5 big-ip advanced web application firewall
f5 big-ip analytics
f5 big-ip application acceleration manager
f5 big-ip application security manager
f5 big-ip application visibility and reporting
f5 big-ip carrier-grade nat
f5 big-ip ddos hybrid defender
f5 big-ip domain name system
f5 big-ip edge gateway
f5 big-ip fraud protection service
f5 big-ip global traffic manager
f5 big-ip link controller
f5 big-ip local traffic manager
f5 big-ip policy enforcement manager
f5 big-ip ssl orchestrator
f5 big-ip webaccelerator
f5 big-ip websafe
f5 f5os-c 1.5.1
f5 f5os-c 1.5.0
f5 f5os-c
f5 f5os-a 1.3.1
f5 f5os-a 1.3.0
hpe arubaos-cx
stormshield stormshield network security
stormshield stormshield management center

D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange. (read-only clone of the original GitLab project)

D(HE)ater D(HE)ater is the proof-of-concept implementation of the D(HE)at attack (CVE-2002-20001) For further information vist PoC code section of the project page License The code is available under the terms of Apache License Version 20 A non-comprehensive, but straightforward description and also the full license text can be found at Choose an open source license website

Curated List of Links Below are links for: Linux Networking DevOps Python Web Development AI Hacking SQL Linux Linux Operating System - Crash Course for Beginners - Learn the basics of the Linux Operating System in this crash course for beginners Linux is a clone of the UNIX operating system, so understanding one is understanding the other The goal is for you to get a full

D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange. (read-only clone of the original GitLab project)

D(HE)ater D(HE)ater is the proof-of-concept implementation of the D(HE)at attack (CVE-2002-20001) For further information vist PoC code section of the project page License The code is available under the terms of Apache License Version 20 A non-comprehensive, but straightforward description and also the full license text can be found at Choose an open source license website

CWE-400 https://github.com/Balasys/dheater https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol https://github.com/mozilla/ssl-config-generator/issues/162 https://www.reddit.com/r/netsec/comments/qdoosy/server_overload_by_enforcing_dhe_key_exchange/https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf https://support.f5.com/csp/article/K83120834 https://www.openssl.org/blog/blog/2022/10/21/tls-groups-configuration/https://www.suse.com/support/kb/doc/?id=000020510 https://dheatattack.com https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2022-004.txt https://gitlab.com/dheatattack/dheater https://dheatattack.gitlab.io/https://ieeexplore.ieee.org/document/10374117 https://nvd.nist.gov https://github.com/c0r0n3r/dheater https://www.cisa.gov/uscert/ics/advisories/icsa-22-314-10

CVE-2002-20001

Vulnerability Summary

Vulnerability Trend

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect