Lucene search

[email protected]CVE-2017-17382

HistoryDec 13, 2017 - 4:29 p.m.

CVE-2017-17382

2017-12-1316:29:00

CWE-327

[email protected]

web.nvd.nist.gov

citrix

netscaler

adc

gateway

tls

decryption

security

vulnerability

robot attack

cve-2017-17382

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.3%

JSON

Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.5 before build 67.13, 11.0 before build 71.22, 11.1 before build 56.19, and 12.0 before build 53.22 might allow remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a ROBOT attack.

CPENameOperatorVersion
citrix:application_delivery_controller_firmwarecitrix application delivery controller firmwareeq12.0
citrix:application_delivery_controller_firmwarecitrix application delivery controller firmwareeq11.0
citrix:application_delivery_controller_firmwarecitrix application delivery controller firmwareeq11.1
citrix:application_delivery_controller_firmwarecitrix application delivery controller firmwareeq10.5
citrix:netscaler_gateway_firmwarecitrix netscaler gateway firmwareeq11.0
citrix:netscaler_gateway_firmwarecitrix netscaler gateway firmwareeq10.5
citrix:netscaler_gateway_firmwarecitrix netscaler gateway firmwareeq11.1
citrix:netscaler_gateway_firmwarecitrix netscaler gateway firmwareeq12.0

CPE	Name	Operator	Version
citrix:application_delivery_controller_firmware	citrix application delivery controller firmware	eq	12.0
citrix:application_delivery_controller_firmware	citrix application delivery controller firmware	eq	11.0
citrix:application_delivery_controller_firmware	citrix application delivery controller firmware	eq	11.1
citrix:application_delivery_controller_firmware	citrix application delivery controller firmware	eq	10.5
citrix:netscaler_gateway_firmware	citrix netscaler gateway firmware	eq	11.0
citrix:netscaler_gateway_firmware	citrix netscaler gateway firmware	eq	10.5
citrix:netscaler_gateway_firmware	citrix netscaler gateway firmware	eq	11.1
citrix:netscaler_gateway_firmware	citrix netscaler gateway firmware	eq	12.0

References

www.securityfocus.com/bid/102173

www.securitytracker.com/id/1039985

robotattack.org/

support.citrix.com/article/ctx230238

www.kb.cert.org/vuls/id/144389

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.3%

JSON

Related for CVE-2017-17382

prion1 citrix1 nessus2 cert1 checkpoint_advisories1 ibm1