750
VMScore

CVE-2017-17428

Published: 05/03/2018 Updated: 03/10/2019
CVSS v2 Base Score: 7.1 | Impact Score: 6.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2
VMScore: 750
Vector: AV:N/AC:M/Au:N/C:C/I:N/A:N

Vulnerability Summary

Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote malicious users to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

Vulnerable Product Search on Vulmon Subscribe to Product

cavium nitrox v ssl sdk

cavium nitrox ssl sdk

cavium turbossl sdk

cavium octeon ssl sdk

cavium octeon sdk

cisco webex meetings t31

cisco webex meetings t32

cisco webex conect im 7.24.1

cisco ace4710 application control engine firmware 3.0(0)a5(2.0)

cisco ace4710 application control engine firmware 3.0(0)a5(3.0)

cisco ace4710 application control engine firmware 3.0(0)a5(3.5)

cisco ace30 application control engine module firmware 3.0(0)a5(2.0)

cisco ace30 application control engine module firmware 3.0(0)a5(3.0)

cisco ace30 application control engine module firmware 3.0(0)a5(3.5)

cisco adaptive security appliance 5520 firmware 9.1(7.16)

cisco adaptive security appliance 5540 firmware 9.1(7.16)

cisco adaptive security appliance 5550 firmware 9.1(7.16)

cisco adaptive security appliance 5510 firmware 9.1(7.16)

cisco adaptive security appliance 5505 firmware 9.1(7.16)

Vendor Advisories

On December 12, 2017, a research paper with the title Return of Bleichenbacher's Oracle Threat was made publicly available This paper describes how some Transport Layer Security (TLS) stacks are vulnerable to variations of the classic Bleichenbacher attack on RSA key exchange Multiple vulnerabilities were identified based on this research An a ...