CVE-2002-20001 The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-expo...
HighCVSS 7.5
EPSS 24.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| balasys dheater | All versions | No fix listed |
| Siemens scalance w1750d firmware | All versions | No fix listed |
| SUSE linux enterprise server | = 11 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise server | = 15 | No fix listed |
| f5 big-ip access policy manager | >= 13.1.0, < 16.1.4 | 16.1.4 |
| f5 big-ip access policy manager | >= 17.0.0, < 17.1.0 | 17.1.0 |
| f5 big-ip advanced firewall manager | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip advanced firewall manager | = 17.5.0 | No fix listed |
| f5 big-ip advanced web application firewall | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip advanced web application firewall | = 17.5.0 | No fix listed |
| f5 big-ip analytics | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip analytics | = 17.5.0 | No fix listed |
| f5 big-ip application acceleration manager | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip application acceleration manager | = 17.5.0 | No fix listed |
| f5 big-ip application security manager | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip application security manager | = 17.5.0 | No fix listed |
| f5 big-ip application visibility and reporting | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip application visibility and reporting | = 17.5.0 | No fix listed |
| f5 big-ip carrier-grade nat | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip carrier-grade nat | = 17.5.0 | No fix listed |
| f5 big-ip ddos hybrid defender | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip ddos hybrid defender | = 17.5.0 | No fix listed |
| f5 big-ip domain name system | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip domain name system | = 17.5.0 | No fix listed |
Show 39 more
| Product | Affected versions | Fixed in |
|---|---|---|
| f5 big-ip edge gateway | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip edge gateway | = 17.5.0 | No fix listed |
| f5 big-ip fraud protection service | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip fraud protection service | = 17.5.0 | No fix listed |
| f5 big-ip global traffic manager | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip global traffic manager | = 17.5.0 | No fix listed |
| f5 big-ip link controller | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip link controller | = 17.5.0 | No fix listed |
| f5 big-ip local traffic manager | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip local traffic manager | = 17.5.0 | No fix listed |
| f5 big-ip policy enforcement manager | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip policy enforcement manager | = 17.5.0 | No fix listed |
| f5 big-ip service proxy | = 1.6.0 | No fix listed |
| f5 big-ip ssl orchestrator | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip ssl orchestrator | = 17.5.0 | No fix listed |
| f5 big-ip webaccelerator | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip webaccelerator | = 17.5.0 | No fix listed |
| f5 big-ip websafe | >= 13.1.0, <= 17.1.2 | No fix listed |
| f5 big-ip websafe | = 17.5.0 | No fix listed |
| f5 big-iq centralized management | >= 8.0.0, <= 8.4.0 | No fix listed |
| f5 big-iq centralized management | = 7.1.0 | No fix listed |
| f5 traffix signaling delivery controller | = 5.1.0 | No fix listed |
| f5 traffix signaling delivery controller | = 5.2.0 | No fix listed |
| F5OS-A | >= 1.3.0, <= 1.3.2 | No fix listed |
| F5OS-A | >= 1.5.0, <= 1.5.3 | No fix listed |
| F5OS-A | = 1.8.0 | No fix listed |
| F5OS-C | >= 1.3.0, <= 1.3.2 | No fix listed |
| F5OS-C | >= 1.6.0, <= 1.6.2 | No fix listed |
| F5OS-C | = 1.5.0 | No fix listed |
| F5OS-C | = 1.5.1 | No fix listed |
| F5OS-C | = 1.8.0 | No fix listed |
| F5OS-C | = 1.8.1 | No fix listed |
| hpe arubaos-cx | >= 10.06.0000, < 10.06.0180 | 10.06.0180 |
| hpe arubaos-cx | >= 10.07.0000, < 10.07.0030 | 10.07.0030 |
| hpe arubaos-cx | >= 10.08.0000, < 10.08.0010 | 10.08.0010 |
| hpe arubaos-cx | >= 10.09.0000, < 10.09.0002 | 10.09.0002 |
| stormshield management center | < 3.3.3 | 3.3.3 |
| Stormshield Network Security | >= 2.7.0, < 4.3.16 | 4.3.16 |
| Stormshield Network Security | >= 4.4.0, < 4.6.3 | 4.6.3 |
References
- github.com product third-party-advisory
- www.researchgate.net exploit technical-description
- www.reddit.com issue-tracking
- github.com issue-tracking
- cert-portal.siemens.com third-party-advisory
- www.suse.com third-party-advisory
- www.openssl.org third-party-advisory
- www.arubanetworks.com technical-description third-party-advisory
- support.f5.com third-party-advisory
- dheatattack.com third-party-advisory
- gitlab.com third-party-advisory
- dheatattack.gitlab.io third-party-advisory
- ieeexplore.ieee.org technical-description third-party-advisory