Vulnerabilities > CVE-2017-13099 - Information Exposure Through Discrepancy vulnerability in multiple products
Attack vector
NETWORK Attack complexity
HIGH Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application. This vulnerability is referred to as "ROBOT."
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Metasploit
| description | Some TLS implementations handle errors processing RSA key exchanges and encryption (PKCS #1 v1.5 messages) in a broken way that leads an adaptive chosen-chiphertext attack. Attackers cannot recover a server's private key, but they can decrypt and sign messages with it. A strong oracle occurs when the TLS server does not strictly check message formatting and needs less than a million requests on average to decode a given ciphertext. A weak oracle server strictly checks message formatting and often requires many more requests to perform the attack. This module requires Python 3 with the gmpy2 and cryptography packages to be present. |
| id | MSF:AUXILIARY/SCANNER/SSL/BLEICHENBACHER_ORACLE |
| last seen | 2020-03-09 |
| modified | 2018-08-27 |
| published | 2018-02-02 |
| references |
|
| reporter | Rapid7 |
| source | https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/scanner/ssl/bleichenbacher_oracle.py |
| title | Scanner for Bleichenbacher Oracle in RSA PKCS #1 v1.5 |
Nessus
| NASL family | General |
| NASL id | SSL_ROBOT_BLEICHENBACHER.NASL |
| description | The remote host is affected by an information disclosure vulnerability. The SSL/TLS service supports RSA key exchanges, and incorrectly leaks whether or not the RSA key exchange sent by a client was correctly formatted. This information can allow an attacker to decrypt previous SSL/TLS sessions or impersonate the server. Note that this plugin does not attempt to recover an RSA ciphertext, however it sends a number of correct and malformed RSA ciphertexts as part of an SSL handshake and observes how the server responds. This plugin attempts to discover the vulnerability in multiple ways, by not completing the handshake and by completing it incorrectly, as well as using a variety of cipher suites. Only the first method that finds the service to be vulnerable is reported. This plugin requires report paranoia as some services will report as affected even though the issue is not exploitable. |
| last seen | 2020-04-07 |
| modified | 2017-12-26 |
| plugin id | 105415 |
| published | 2017-12-26 |
| reporter | This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/105415 |
| title | Return Of Bleichenbacher's Oracle Threat (ROBOT) Information Disclosure |
References
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-002.txt
- http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2018-002.txt
- http://www.kb.cert.org/vuls/id/144389
- http://www.kb.cert.org/vuls/id/144389
- http://www.securityfocus.com/bid/102174
- http://www.securityfocus.com/bid/102174
- https://cert-portal.siemens.com/productcert/pdf/ssa-464260.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-464260.pdf
- https://github.com/wolfSSL/wolfssl/pull/1229
- https://github.com/wolfSSL/wolfssl/pull/1229
- https://robotattack.org/
- https://robotattack.org/