CVE-2017-17427 : Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vul

Radware Alteon devices with a firmware version between 31.0.0.0-31.0.3.0 are vulnerable to an adaptive-chosen ciphertext attack ("Bleichenbacher attack"). This allows an attacker to decrypt observed traffic that has been encrypted with the RSA cipher and to perform other private key operations.

Published 2017-12-13 16:29:00

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-17427

Radware » Alteon Firmware
Versions from including (>=) 31.0.0.0 and up to, including, (<=) 31.0.3.0
cpe:2.3:o:radware:alteon_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Radware » Alteon » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-17427

EPSS FAQ

0.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 63 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-17427

Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5

Disclosure Date: 2009-06-17

First seen: 2020-04-26

auxiliary/scanner/ssl/bleichenbacher_oracle

Some TLS implementations handle errors processing RSA key exchanges and encryption (PKCS #1 v1.5 messages) in a broken way that leads an adaptive chosen-chiphertext attack. Attackers cannot recover a server's private key, but they can decrypt and sign messages with i

More information

CVSS scores for CVE-2017-17427

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.9	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-17427

CWE-203 Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-17427

https://www.kb.cert.org/vuls/id/144389

VU#144389 - TLS implementations may disclose side channel information via discrepancies between valid and invalid PKCS#1 padding
Third Party Advisory;US Government Resource

CVEs referencing this url
https://support.radware.com/app/answers/answer_view/a_id/1010361/~/cve-2017-17427-adaptive-chosen-ciphertext-attack-vulnerability

CVE-2017-17427 Adaptive chosen-ciphertext attack vulnerability
Mitigation;Vendor Advisory
https://robotattack.org/

The ROBOT Attack - Return of Bleichenbacher's Oracle Threat
Technical Description

CVEs referencing this url
http://www.securityfocus.com/bid/102199

Alteon CVE-2017-17427 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry

Jump to