CVE-2017-17428

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-17428
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

7.1 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:M/Au:N/C:C/I:N/A:N

Exploitability : 8.6 / Impact : 6.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://www.securityfocus.com/bid/102170 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039984 Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher Third Party Advisory
https://www.cavium.com/security-advisory-cve-2017-17428.html Vendor Advisory
https://www.kb.cert.org/vuls/id/144389 Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/102170 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039984 Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher Third Party Advisory
https://www.cavium.com/security-advisory-cve-2017-17428.html Vendor Advisory
https://www.kb.cert.org/vuls/id/144389 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cavium:nitrox_ssl_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:cavium:nitrox_v_ssl_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:cavium:octeon_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:cavium:octeon_ssl_sdk:*:*:*:*:*:*:*:*
cpe:2.3:a:cavium:turbossl_sdk:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:cisco:webex_conect_im:7.24.1:*:*:*:*:*:*:*
cpe:2.3:a:cisco:webex_meetings:t31:*:*:*:*:*:*:*
cpe:2.3:a:cisco:webex_meetings:t32:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:o:cisco:ace4710_application_control_engine_firmware:3.0\(0\)a5\(2.0\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:ace4710_application_control_engine_firmware:3.0\(0\)a5\(3.0\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:ace4710_application_control_engine_firmware:3.0\(0\)a5\(3.5\):*:*:*:*:*:*:*
cpe:2.3:h:cisco:ace_4710_application_control_engine:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:o:cisco:ace30_application_control_engine_module_firmware:3.0\(0\)a5\(2.0\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:ace30_application_control_engine_module_firmware:3.0\(0\)a5\(3.0\):*:*:*:*:*:*:*
cpe:2.3:o:cisco:ace30_application_control_engine_module_firmware:3.0\(0\)a5\(3.5\):*:*:*:*:*:*:*
cpe:2.3:h:cisco:ace30_application_control_engine_module:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:cisco:adaptive_security_appliance_5520_firmware:9.1\(7.16\):*:*:*:*:*:*:*
cpe:2.3:h:cisco:adaptive_security_appliance_5520:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:cisco:adaptive_security_appliance_5540_firmware:9.1\(7.16\):*:*:*:*:*:*:*
cpe:2.3:h:cisco:adaptive_security_appliance_5540:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:cisco:adaptive_security_appliance_5550_firmware:9.1\(7.16\):*:*:*:*:*:*:*
cpe:2.3:h:cisco:adaptive_security_appliance_5550:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:cisco:adaptive_security_appliance_5510_firmware:9.1\(7.16\):*:*:*:*:*:*:*
cpe:2.3:h:cisco:adaptive_security_appliance_5510:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:cisco:adaptive_security_appliance_5505_firmware:9.1\(7.16\):*:*:*:*:*:*:*
cpe:2.3:h:cisco:adaptive_security_appliance_5505:-:*:*:*:*:*:*:*
History

21 Nov 2024, 03:17

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/102170 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/102170 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1039984 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1039984 - Third Party Advisory, VDB Entry
References () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher - Third Party Advisory () https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacher - Third Party Advisory
References () https://www.cavium.com/security-advisory-cve-2017-17428.html - Vendor Advisory () https://www.cavium.com/security-advisory-cve-2017-17428.html - Vendor Advisory
References () https://www.kb.cert.org/vuls/id/144389 - Third Party Advisory, US Government Resource () https://www.kb.cert.org/vuls/id/144389 - Third Party Advisory, US Government Resource
Information

Published : 2018-03-05 18:29

Updated : 2024-11-21 03:17

NVD link : CVE-2017-17428

Mitre link : CVE-2017-17428

CVE.ORG link : CVE-2017-17428

JSON object : View

Products Affected

cavium

  • turbossl_sdk
  • octeon_ssl_sdk
  • nitrox_ssl_sdk
  • octeon_sdk
  • nitrox_v_ssl_sdk

cisco

  • adaptive_security_appliance_5505
  • ace4710_application_control_engine_firmware
  • ace30_application_control_engine_module
  • adaptive_security_appliance_5510_firmware
  • ace_4710_application_control_engine
  • adaptive_security_appliance_5510
  • webex_meetings
  • adaptive_security_appliance_5550_firmware
  • adaptive_security_appliance_5550
  • adaptive_security_appliance_5540_firmware
  • adaptive_security_appliance_5540
  • adaptive_security_appliance_5505_firmware
  • adaptive_security_appliance_5520_firmware
  • ace30_application_control_engine_module_firmware
  • adaptive_security_appliance_5520
  • webex_conect_im
CWE
CWE-327

Use of a Broken or Risky Cryptographic Algorithm