CVE-2017-17428 Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT atta...
MediumCVSS 5.9
EPSS 14.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cavium Nitrox SSL, Nitrox V SSL, and TurboSSL software development kits (SDKs) allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cavium nitrox ssl sdk | <= 6.1.0 | No fix listed |
| cavium nitrox v ssl sdk | <= 1.2 | No fix listed |
| cavium octeon sdk | <= 1.7.2 | No fix listed |
| cavium octeon ssl sdk | <= 1.5.0 | No fix listed |
| cavium turbossl sdk | <= 1.0 | No fix listed |
| cisco webex conect im | = 7.24.1 | No fix listed |
| cisco webex meetings | = t31 | No fix listed |
| cisco webex meetings | = t32 | No fix listed |
| cisco ace4710 application control engine firmware | = 3.0(0)a5(2.0) | No fix listed |
| cisco ace4710 application control engine firmware | = 3.0(0)a5(3.0) | No fix listed |
| cisco ace4710 application control engine firmware | = 3.0(0)a5(3.5) | No fix listed |
| cisco ace30 application control engine module firmware | = 3.0(0)a5(2.0) | No fix listed |
| cisco ace30 application control engine module firmware | = 3.0(0)a5(3.0) | No fix listed |
| cisco ace30 application control engine module firmware | = 3.0(0)a5(3.5) | No fix listed |
| cisco adaptive security appliance 5520 firmware | = 9.1(7.16) | No fix listed |
| cisco adaptive security appliance 5540 firmware | = 9.1(7.16) | No fix listed |
| cisco adaptive security appliance 5550 firmware | = 9.1(7.16) | No fix listed |
| cisco adaptive security appliance 5510 firmware | = 9.1(7.16) | No fix listed |
| cisco adaptive security appliance 5505 firmware | = 9.1(7.16) | No fix listed |
References
- 102170 third-party-advisory vdb-entry
- 1039984 third-party-advisory vdb-entry
- 20171212 Bleichenbacher Attack on TLS Affecting Cisco Products: December 2017 third-party-advisory vendor-advisory
- www.cavium.com vendor-advisory
- VU#144389 third-party-advisory us-government-resource