TLS Padding Oracle in Cisco Adaptive Security Appliance (ASA) - CVE-2017-12373
Published: January 3, 2024
Vulnerability identifier: #VU84952
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12373
CWE-ID: CWE-310
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to decrypt TLS traffic.
The vulnerability exists due to an error in TLS implementation. A remote attacker with ability to establish a large number of TLS connections with the target server can conduct an adaptive-chosen ciphertext attack against RSA cipher and gain access to sensitive information.
The attack is known as "ROBOT" (Return Of Bleichenbacher's Oracle Threat).
Affected software
Cisco Adaptive Security Appliance (ASA)
How to mitigate CVE-2017-12373
Install updates from vendor's website.
Cisco Adaptive Security Appliance (ASA) - addressed in versions 9.1.7.21, 9.2.4.25