« Volver al listado

CVE-2017-15533

Estado: ModificadaMedia (5.9)—

Symantec SSL Visibility (SSLV) 3.8.4FC, 3.10 prior to 3.10.4.1, 3.11, and 3.12 prior to 3.12.2.1 are vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. All affected SSLV versions act as weak oracles according the oracle classification used in the ROBOT research paper. A remote attacker, who has captured a pre-recorded SSL session inspected by SSLV, can establish multiple millions of crafted SSL connections to the target and obtain the session keys required to decrypt the pre-recorded SSL session.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Broadcom — SSL Visibility Appliance

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-15533",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "secure@symantec.com",
      "affectedData": [
        {
          "vendor": "Symantec Corporation",
          "product": "SSL Visibility (SSLV)",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.4FC"
            },
            {
              "status": "affected",
              "version": "3.10 prior to 3.10.4.1"
            },
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "status": "affected",
              "version": "3.12 prior to 3.12.2.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-17T13:29:00.210",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/104163",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "https://www.symantec.com/security-center/network-protection-security-advisories/SA160",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@symantec.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/104163",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.symantec.com/security-center/network-protection-security-advisories/SA160",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-203"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Symantec SSL Visibility (SSLV) 3.8.4FC, 3.10 prior to 3.10.4.1, 3.11, and 3.12 prior to 3.12.2.1 are vulnerable to the Return of the Bleichenbacher Oracle Threat (ROBOT) attack. All affected SSLV versions act as weak oracles according the oracle classification used in the ROBOT research paper. A remote attacker, who has captured a pre-recorded SSL session inspected by SSLV, can establish multiple millions of crafted SSL connections to the target and obtain the session keys required to decrypt the pre-recorded SSL session."
    },
    {
      "lang": "es",
      "value": "Symantec SSL Visibility (SSLV) 3.8.4FC, versiones 3.10 anteriores a la 3.10.4.1, 3.11, y versiones 3.12 anteriores a la 3.12.2.1 son vulnerables a un ataque ROBOT (Return of the Bleichenbacher Oracle Threat). Todas las versiones afectadas de SSLV actúan como oráculos débiles, según la clasificación de oráculos empleada en el documento de investigación de ROBOT. Un atacante remoto que haya capturado una sesión SSL previamente grabada inspeccionada por SSLV puede establecer millones de conexiones SSL manipuladas en el objetivo y obtener las claves de sesión necesarias para descifrar la sesión SSL pregrabada."
    }
  ],
  "lastModified": "2026-06-17T01:07:51.513",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:ssl_visibility_appliance:3.8.4fc:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5207441A-FB6D-400F-9151-012DCF01885B"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:ssl_visibility_appliance:3.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "629C7D06-4DD7-478E-831D-4F6DB9DFF8AE"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:ssl_visibility_appliance:3.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B231AB3B-4BFD-4A7A-928C-CDF23FD21D48"
            },
            {
              "criteria": "cpe:2.3:a:broadcom:ssl_visibility_appliance:3.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52526D68-F66D-459B-A007-F32BEAFB5CA8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@symantec.com"
}