CVE Vulnerabilities

CVE-2017-11506

Improper Certificate Validation

Published: Aug 09, 2017 | Modified: Aug 24, 2017
CVSS 3.x
7.4
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 2.x
5.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

When linking a Nessus scanner or agent to Tenable.io or other manager, Nessus 6.x before 6.11 does not verify the managers TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks.

Weakness

The product does not validate, or incorrectly validates, a certificate.

Affected Software

Name Vendor Start Version End Version
Nessus Tenable 6.3.7 6.3.7
Nessus Tenable 6.10.7 6.10.7
Nessus Tenable 6.6.1 6.6.1
Nessus Tenable 6.10.9 6.10.9
Nessus Tenable 6.5.3 6.5.3
Nessus Tenable 6.9.1 6.9.1
Nessus Tenable 6.5.6 6.5.6
Nessus Tenable 6.10.4 6.10.4
Nessus Tenable 6.6.0 6.6.0
Nessus Tenable 6.1.2 6.1.2
Nessus Tenable 6.5.5 6.5.5
Nessus Tenable 6.0.2 6.0.2
Nessus Tenable 6.3.1 6.3.1
Nessus Tenable 6.2.1 6.2.1
Nessus Tenable 6.10.3 6.10.3
Nessus Tenable 6.1.0 6.1.0
Nessus Tenable 6.5.4 6.5.4
Nessus Tenable 6.7.0 6.7.0
Nessus Tenable 6.4.1 6.4.1
Nessus Tenable 6.10.1 6.10.1
Nessus Tenable 6.4.2 6.4.2
Nessus Tenable 6.3.4 6.3.4
Nessus Tenable 6.9.3 6.9.3
Nessus Tenable 6.10.8 6.10.8
Nessus Tenable 6.9.2 6.9.2
Nessus Tenable 6.8.1 6.8.1
Nessus Tenable 6.3.3 6.3.3
Nessus Tenable 6.5.0 6.5.0
Nessus Tenable 6.3.2 6.3.2
Nessus Tenable 6.10.2 6.10.2
Nessus Tenable 6.3.6 6.3.6
Nessus Tenable 6.8.0 6.8.0
Nessus Tenable 6.5.1 6.5.1
Nessus Tenable 6.9.0 6.9.0
Nessus Tenable 6.2.0 6.2.0
Nessus Tenable 6.0.0 6.0.0
Nessus Tenable 6.6.2 6.6.2
Nessus Tenable 6.10.5 6.10.5
Nessus Tenable 6.1.1 6.1.1
Nessus Tenable 6.0.1 6.0.1
Nessus Tenable 6.5.2 6.5.2
Nessus Tenable 6.4.3 6.4.3
Nessus Tenable 6.3.5 6.3.5
Nessus Tenable 6.10.0 6.10.0
Nessus Tenable 6.4.0 6.4.0
Nessus Tenable 6.10.6 6.10.6
Nessus Tenable 6.3.0 6.3.0

Potential Mitigations

References