Sign-up

ID

VAR-201704-0652


CVE

CVE-2017-5670


TITLE

Riverbed RiOS Vulnerability in which important information is obtained

Trust: 0.8

sources: JVNDB: JVNDB-2017-002925

DESCRIPTION

Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate attackers to obtain sensitive information by reading raw disk blocks. RiverbedSteelhead is a hardware device used to optimize and accelerate network traffic. Implemented as a TLS endpoint, they have a secure library that stores the server's private TLS certificate. There is a local security bypass vulnerability in RiverbedRiOS. The attacker exploited the vulnerability to bypass some security restrictions and perform unauthorized operations

Trust: 2.43

sources: NVD: CVE-2017-5670 // JVNDB: JVNDB-2017-002925 // CNVD: CNVD-2017-01873 // BID: 96175

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2017-01873

AFFECTED PRODUCTS

vendor:riverbedmodel:riosscope:lteversion:9.6.0

Trust: 1.8

vendor:riverbedmodel:riosscope:eqversion:0

Trust: 0.9

vendor:riverbedmodel:riosscope:eqversion:9.6.0

Trust: 0.6

sources: CNVD: CNVD-2017-01873 // BID: 96175 // JVNDB: JVNDB-2017-002925 // CNNVD: CNNVD-201702-746 // NVD: CVE-2017-5670

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-5670
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-5670
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-01873
value: LOW

Trust: 0.6

CNNVD: CNNVD-201702-746
value: LOW

Trust: 0.6

nvd@nist.gov: CVE-2017-5670
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-01873
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2017-5670
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: PHYSICAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 0.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2017-01873 // JVNDB: JVNDB-2017-002925 // CNNVD: CNNVD-201702-746 // NVD: CVE-2017-5670

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2017-002925 // NVD: CVE-2017-5670

THREAT TYPE

local

Trust: 0.9

sources: BID: 96175 // CNNVD: CNNVD-201702-746

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201702-746

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-002925

PATCH
title:Riverbed Security Advisory for CVE-2017-5670, CVE-2017-7305, CVE-2017-7306, and CVE-2017-7307url:https://supportkb.riverbed.com/support/index?page=content&id=S30065
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2017-002925

EXTERNAL IDS
db:NVDid:CVE-2017-5670
Trust: 3.3
db:BIDid:96175
Trust: 2.5
db:JVNDBid:JVNDB-2017-002925
Trust: 0.8
db:CNVDid:CNVD-2017-01873
Trust: 0.6
db:CNNVDid:CNNVD-201702-746
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-01873 // 
            
            
            
            BID: 96175 // 
            
            
            
            JVNDB: JVNDB-2017-002925 // 
            
            
            
            CNNVD: CNNVD-201702-746 // 
            
            
            
            NVD: CVE-2017-5670

REFERENCES
url:http://seclists.org/fulldisclosure/2017/feb/25
Trust: 2.4
url:http://www.securityfocus.com/bid/96175
Trust: 2.2
url:https://supportkb.riverbed.com/support/index?page=content&id=s30065
Trust: 1.6
url:https://sysdream.com/news/lab/2017-02-15-riverbed-rios-insecure-cryptographic-storage-cve-2017-5670/
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5670
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-5670
Trust: 0.8
url:www.riverbed.com
Trust: 0.3
url:http://seclists.org/fulldisclosure/2017/feb/25 
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-01873 // 
            
            
            
            BID: 96175 // 
            
            
            
            JVNDB: JVNDB-2017-002925 // 
            
            
            
            CNNVD: CNNVD-201702-746 // 
            
            
            
            NVD: CVE-2017-5670

CREDITS
Jean-Christophe Baptiste
Trust: 0.9
sources:
            
            
            BID: 96175 // 
            
            
            
            CNNVD: CNNVD-201702-746

SOURCES
db:CNVDid:CNVD-2017-01873
db:BIDid:96175
db:JVNDBid:JVNDB-2017-002925
db:CNNVDid:CNNVD-201702-746
db:NVDid:CVE-2017-5670

LAST UPDATE DATE
2025-04-20T23:36:55.564000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-01873date:2017-02-24T00:00:00
db:BIDid:96175date:2017-03-07T03:02:00
db:JVNDBid:JVNDB-2017-002925date:2017-05-09T00:00:00
db:CNNVDid:CNNVD-201702-746date:2017-04-07T00:00:00
db:NVDid:CVE-2017-5670date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2017-01873date:2017-02-24T00:00:00
db:BIDid:96175date:2017-02-13T00:00:00
db:JVNDBid:JVNDB-2017-002925date:2017-05-09T00:00:00
db:CNNVDid:CNNVD-201702-746date:2017-02-22T00:00:00
db:NVDid:CVE-2017-5670date:2017-04-04T16:59:00.207