CVE-2017-12373
Last modified
CVE-2017-12373 is a vulnerability of currently unknown severity. A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. EPSS estimates a 12.80% chance of exploitation in the next 30 days.
Description
A vulnerability in the TLS protocol implementation of legacy Cisco ASA 5500 Series (ASA 5505, 5510, 5520, 5540, and 5550) devices could allow an unauthenticated, remote attacker to access sensitive information, aka a Return of Bleichenbacher's Oracle Threat (ROBOT) attack. An attacker could iteratively query a server running a vulnerable TLS stack implementation to perform cryptanalytic operations that may allow decryption of previously captured TLS sessions. Cisco Bug IDs: CSCvg97652.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Adaptive Security Appliance 5505 Firmware | All versions |
| Cisco | Adaptive Security Appliance 5510 Firmware | All versions |
| Cisco | Adaptive Security Appliance 5520 Firmware | All versions |
| Cisco | Adaptive Security Appliance 5540 Firmware | All versions |
| Cisco | Adaptive Security Appliance 5550 Firmware | All versions |
References
- http://www.securityfocus.com/bid/102170Third Party Advisory, VDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacherIssue Tracking, Mitigation, Vendor Advisory
- http://www.securityfocus.com/bid/102170Third Party Advisory, VDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171212-bleichenbacherIssue Tracking, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-12373?
How severe is CVE-2017-12373?
How do I fix CVE-2017-12373?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-12368A "Cisco WebEx Network Recording Player Remote Code Executio…
- CVE-2017-12369A "Cisco WebEx Network Recording Player Out-of-Bounds Vulner…
- CVE-2017-1237IBM Jazz based applications are vulnerable to cross-site scr…5.4
- CVE-2017-12370A "Cisco WebEx Network Recording Player Remote Code Executio…
- CVE-2017-12371A "Cisco WebEx Network Recording Player Remote Code Executio…
- CVE-2017-12372A "Cisco WebEx Network Recording Player Remote Code Executio…
- CVE-2017-12374The ClamAV AntiVirus software versions 0.99.2 and prior cont…
- CVE-2017-12375The ClamAV AntiVirus software versions 0.99.2 and prior cont…
- CVE-2017-12376ClamAV AntiVirus software versions 0.99.2 and prior contain …
- CVE-2017-12377ClamAV AntiVirus software versions 0.99.2 and prior contain …
- CVE-2017-12378ClamAV AntiVirus software versions 0.99.2 and prior contain …
- CVE-2017-12379ClamAV AntiVirus software versions 0.99.2 and prior contain …
Are you affected by CVE-2017-12373?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST