CVE-2019-1715
published 2019-05-03CVE-2019-1715: A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance…
PriorityP346high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
1.71%
74.9th percentile
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or from an affected target device.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | adaptive_security_appliance | — | — |
| cisco | adaptive_security_appliance_device_manager | >= 9.8 < 9.8.4 | 9.8.4 |
| cisco | adaptive_security_appliance_device_manager | >= 9.9 < 9.9.2.50 | 9.9.2.50 |
| cisco | cisco_adaptive_security_appliance_software | >= unspecified < 9.8.4 | 9.8.4 |
| cisco | cisco_adaptive_security_appliance_software | >= unspecified < 9.9.2.50 | 9.9.2.50 |
| cisco | cisco_firepower_threat_defense_software | >= unspecified < 6.2.3.12 | 6.2.3.12 |
| cisco | cisco_firepower_threat_defense_software | >= unspecified < 6.3.0.3 | 6.3.0.3 |
| cisco | firepower_threat_defense | >= 6.2.1 < 6.2.3.12 | 6.2.3.12 |
| cisco | firepower_threat_defense | >= 6.3.0 < 6.3.0.3 | 6.3.0.3 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
vendor_cisco·2019-05-01·CVSS 5.3
CVE-2019-1715 [MEDIUM] CWE-332 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
A vulnerability in the Deterministic Random Bit Generator (DRBG), also
known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive
Security Appliance (ASA) Software and Cisco Firepower Threat Defense
(FTD) Software could allow an unauthenticated, remote attacker to cause a
cryptographic collision, enabling the attacker to discover the private
key of an affected device.
The vulnerability is due to
insufficient entropy in the DRBG when generating cryptographic keys. An
attacker could exploit this vulnerability by generating a large number
of cryptographic keys on an affected device and looking for collisions
with target devices. A successful exploit could allow the atta
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
vendor_cisco·CVSS 3.0
CVE-2019-1715 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
CVE-2019-1715: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could a
GHSA
GHSA-f5gw-c8rq-f9v2: A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security
ghsa_unreviewed·2022-05-24
CVE-2019-1715 [HIGH] CWE-332 GHSA-f5gw-c8rq-f9v2: A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security
A vulnerability in the Deterministic Random Bit Generator (DRBG), also known as Pseudorandom Number Generator (PRNG), used in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a cryptographic collision, enabling the attacker to discover the private key of an affected device. The vulnerability is due to insufficient entropy in the DRBG when generating cryptographic keys. An attacker could exploit this vulnerability by generating a large number of cryptographic keys on an affected device and looking for collisions with target devices. A successful exploit could allow the attacker to impersonate an affected target device or to decrypt traffic secured by an affected key that is sent to or
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Insufficient Entropy in PRNG
mitre_cwe
CWE-332 Insufficient Entropy in PRNG
CWE-332: Insufficient Entropy in PRNG
The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Note: REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Common Consequences:
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. If a pseudo-random number generator is using a limited entropy source which runs out (if the generator fails closed), the program may pause or crash.
Scope: Access Control, Other. Impact: Bypass Protection Mechanism, Other. If a PRNG is using a limited entropy source which runs out, and the generator fails open, the generator could produce predictable random numbers. Pote
CWE
Use of a Cryptographic Primitive with a Risky Implementation
mitre_cwe
CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
Cryptographic protocols and systems depend on cryptographic primitives (and associated algorithms) as their basic building blocks. Some common examples of primitives are digital signatures, one-way hash functions, ciphers, and public key cryptography; however, the notion of "primitive" can vary depending on point of view. See "Terminology Notes" for further explanation of some concepts. Cryptographic primitives are defined to accomplish one very specific task in a precisely defined and mathematically reliable fashion. For example,
2019-05-03
Published