CVE-2017-5933 - Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270

Back Back to CVE browser

MEDIUM

Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270

Published Feb 8, 2017

5.9

MEDIUM

CVSS 3.0

EPSS 3.18%

Description

Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

http://www.securityfocus.com/bid/96151
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-15007
Advisory
https://github.com/nonce-disrespect/nonce-disrespect
x_refsource_MISCThird Party Advisory
https://support.citrix.com/article/CTX220329
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/96151		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-15007		Advisory
https://github.com/nonce-disrespect/nonce-disrespect		x_refsource_MISCThird Party Advisory
https://support.citrix.com/article/CTX220329		x_refsource_CONFIRMVendor Advisory