Rapid7 Vulnerability & Exploit Database

ROCA: Vulnerable RSA generation from Infineon TPM (CVE-2017-15361)

Back to Search

ROCA: Vulnerable RSA generation from Infineon TPM (CVE-2017-15361)

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Published
10/16/2017
Created
07/25/2018
Added
11/02/2017
Modified
12/01/2017

Description

The Infineon RSA library version 1.02.013 does not properly generate RSA key pairs. As a result, the keyspace required for a brute force search is lessened such that it is feasible to factorize keys under at least 2048 bits and obtain the RSA private key. The attacker needs only access to the victim's RSA public key generated by this library in order to calculate the private key.

This is also known as Return of Coppersmith's Attack (ROCA)

Solution(s)

  • infineon-tpm-cve-2017-15361

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;