PT-2017-16417 · Rapid7+1 · Rapid7 Nexpose+1

Liam Somerville · Publicado 2017-06-06 · Atualizado 2019-10-09 · CVE-2017-5243

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rapid7 Nexpose hardware appliances versions prior to June 2017

Description The default SSH configuration does not specify desired algorithms for key exchange and other important functions, allowing all algorithms supported by the relevant version of OpenSSH. This makes the installations vulnerable to man-in-the-middle (MITM), downgrade, and decryption attacks.

Recommendations For Rapid7 Nexpose hardware appliances versions prior to June 2017, consider updating the SSH configuration to specify desired algorithms for key exchange and other important functions to prevent MITM, downgrade, and decryption attacks.

Correção

Use of a Broken Cryptographic Algorithm

Enumeração de Fraquezas

CWE-327

Identificadores relacionados

CVE-2017-5243

Produtos afetados

Openssh

Rapid7 Nexpose

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-5243 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-5243 · Nota de Segurança
• https://community.rapid7.com/community/nexpose/blog/2017/05/31/r7-2017-13-nexpose-hardware-appliance-ssh-enabled-obsolete-algorithms-cve-2017-5243 · Aviso do Fabricante