# SSL/TLS Adaptive Chosen Ciphertext Attack Vulnerability against RSA (ROBOT Attack) **URL:** \ **Category:** Help\ **Created:** [January 20, 2021, 10:32am UTC](https://community.letsencrypt.org/t/ssl-tls-adaptive-chosen-ciphertext-attack-vulnerability-against-rsa-robot-attack/143191 "2021-01-20T10:32:04Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![skaushalye](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@skaushalye](https://community.letsencrypt.org/u/skaushalye)\ **Post date:** [January 20, 2021, 10:32am UTC](https://community.letsencrypt.org/t/ssl-tls-adaptive-chosen-ciphertext-attack-vulnerability-against-rsa-robot-attack/143191/1 "2021-01-20T10:32:04Z")
I got this as a result to my PCI scan. This is like our site is vulnerable to robot attack. (So I am not place my domain here as it is vulnerable to the attack). Can you please let me know what is wrong and what I have to do increase my security? Description The detected service is vulnerable to an Adaptive Chosen Ciphertext attack vulnerability against RSA (aka “ROBOT Attack”). By manipulating the padding on an encrypted string, an attacker could be able to reveal information about the encrypted message by monitoring the error messages returned by the server. The encrypted data could be retrieved if the attacker successfully exploits this flaw. This vulnerability is due to an issue in the implementation of the SSL/TLS protocol. Please refer to the correct CVE and patch (e.g. Reference section) according to the implementation of SSL/TLS running on this host. CVE: CVE-2017-12373,CVE-2017-17428,CVE-2017-17427,CVE-2017-17382,CVE-2017-6168,CVE-2012-5081,CVE-2016-6883,CVE-2017-13099,CVE-2017-1000385,CVE-2017-13098 Solution Please refers to this link [https://robotattack.org/#patches](https://robotattack.org/#patches) for up-to-date fixes, patches and guidance. Reference > **[Cryptology ePrint Archive: Report 2017/1189 - Return Of Bleichenbacher's...](https://eprint.iacr.org/2017/1189)** > **[The ROBOT Attack](https://robotattack.org/)** > > Return of Bleichenbacher's Oracle Threat - ROBOT is the return of a 19-year-old vulnerability that allows performing RSA decryption and signing operations with the private key of a TLS server. Evidence Cryptographic Oracle Strength: Strong (real attack is possible) TLS SSL version: TLSv1.2 Message Flow Type: Standard Message Flow: TLS alert 20 (length 7) / TLS alert 51 (length 7) / TLS alert 20 (length 7) / TLS alert 20 (length 7) / TLS alert 20 (length 7) * * * According to the results in [www.ssllabs.com](http://www.ssllabs.com) following are the amber (warning?) issues: Summary This server supports TLS 1.1. Grade capped to B. [MORE INFO »](https://blog.qualys.com/ssllabs/2018/11/19/grade-change-for-tls-1-0-and-tls-1-1-protocols) Certificate #1: RSA 2048 bits (SHA256withRSA) DNS CAA No ([more info](https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum)) Certificate #2: RSA 2048 bits (SHA256withRSA) No SNI Configuration Protocols TLS 1.1 Yes (but TLS 1.2 Green) Cipher Suites # TLS 1.2 (suites in server-preferred order) | TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384 (0xc028) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 256 | | --- | --- | | TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256 (0x6b) DH 2048 bits FS WEAK | 256 | | TLS\_ECDHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA384 (0xc077) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 256 | | TLS\_DHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA256 (0xc4) DH 2048 bits FS WEAK | 256 | | TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256 (0xc027) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 128 | | TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256 (0x67) DH 2048 bits FS WEAK | 128 | | TLS\_ECDHE\_RSA\_WITH\_CAMELLIA\_128\_CBC\_SHA256 (0xc076) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 128 | | TLS\_DHE\_RSA\_WITH\_CAMELLIA\_128\_CBC\_SHA256 (0xbe) DH 2048 bits FS WEAK | 128 | | TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA (0xc014) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 256 | | TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA (0x39) DH 2048 bits FS WEAK | 256 | | TLS\_DHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA (0x88) DH 2048 bits FS WEAK | 256 | | TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA (0xc013) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 128 | | TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x33) DH 2048 bits FS WEAK | 128 | | TLS\_DHE\_RSA\_WITH\_CAMELLIA\_128\_CBC\_SHA (0x45) DH 2048 bits FS WEAK | 128 | | TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384 (0x9d) WEAK | 256 | | TLS\_RSA\_WITH\_AES\_256\_CCM\_8 (0xc0a1) WEAK | 256 | | TLS\_RSA\_WITH\_AES\_256\_CCM (0xc09d) WEAK | 256 | | TLS\_RSA\_WITH\_ARIA\_256\_GCM\_SHA384 (0xc051) WEAK | 256 | | TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 (0x9c) WEAK | 128 | | TLS\_RSA\_WITH\_AES\_128\_CCM\_8 (0xc0a0) WEAK | 128 | | TLS\_RSA\_WITH\_AES\_128\_CCM (0xc09c) WEAK | 128 | | TLS\_RSA\_WITH\_ARIA\_128\_GCM\_SHA256 (0xc050) WEAK | 128 | | TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256 (0x3d) WEAK | 256 | | TLS\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA256 (0xc0) WEAK | 256 | | TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256 (0x3c) WEAK | 128 | | TLS\_RSA\_WITH\_CAMELLIA\_128\_CBC\_SHA256 (0xba) WEAK | 128 | | TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA (0x35) WEAK | 256 | | TLS\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA (0x84) WEAK | 256 | | TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x2f) WEAK | 128 | | TLS\_RSA\_WITH\_CAMELLIA\_128\_CBC\_SHA (0x41) WEAK | 128 | # TLS 1.1 (suites in server-preferred order) | TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA (0xc014) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 256 | | --- | --- | | TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA (0x39) DH 2048 bits FS WEAK | 256 | | TLS\_DHE\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA (0x88) DH 2048 bits FS WEAK | 256 | | TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA (0xc013) ECDH x25519 (eq. 3072 bits RSA) FS WEAK | 128 | | TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x33) DH 2048 bits FS WEAK | 128 | | TLS\_DHE\_RSA\_WITH\_CAMELLIA\_128\_CBC\_SHA (0x45) DH 2048 bits FS WEAK | 128 | | TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA (0x35) WEAK | 256 | | TLS\_RSA\_WITH\_CAMELLIA\_256\_CBC\_SHA (0x84) WEAK | 256 | | TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x2f) WEAK | 128 | | TLS\_RSA\_WITH\_CAMELLIA\_128\_CBC\_SHA (0x41) WEAK | 128 | My domain is: I ran this command: in the vhost file It produced this output: SSLEngine on SSLProtocol -All +TLSv1.1 +TLSv1.2 SSLCompression Off SSLHonorCipherOrder on SSLCipherSuite "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RC4-SHA:AES256-GCM-SHA384:AES256-SHA256:CAMELLIA256-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4" My web server is (include version): Apache/2.4.46 (Ubuntu) The operating system my web server runs on is (include version): Ubuntu 16.04 My hosting provider, if applicable, is: AWS I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 0.23.0 ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 20, 2021, 10:49am UTC](https://community.letsencrypt.org/t/ssl-tls-adaptive-chosen-ciphertext-attack-vulnerability-against-rsa-robot-attack/143191/2 "2021-01-20T10:49:15Z")
I would start by disabling TLSv1.1: > [@skaushalye](#): > > `SSLProtocol -All +TLSv1.1 +TLSv1.2` Can be changed to: `SSLProtocol -All +TLSv1.2` > [@skaushalye](#): > > SSLCipherSuite "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:RC4-SHA:AES256-GCM-SHA384:AES256-SHA256:CAMELLIA256-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA:CAMELLIA128-SHA !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4" Can be changed to: SSLCipherSuite "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES256-SHA256:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:AES128-SHA256 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4" Then try SSLLabs again. If that still fails, you might want to review these sites: [Mitigating-Obsolete-TLS/webserver at master · nsacyber/Mitigating-Obsolete-TLS · GitHub](https://github.com/nsacyber/Mitigating-Obsolete-TLS/tree/master/webserver) [Security/Server Side TLS - MozillaWiki](https://wiki.mozilla.org/Security/Server_Side_TLS) ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [January 20, 2021, 8:19pm UTC](https://community.letsencrypt.org/t/ssl-tls-adaptive-chosen-ciphertext-attack-vulnerability-against-rsa-robot-attack/143191/3 "2021-01-20T20:19:50Z")
In addition to @rg305's very helpful recommendations, you might want to check that your system is getting software updates and is running software that is still supported. I don't remember the details of the ROBOT vulnerability or its mitigations, but the reference to software patches suggests to me that it might also be fixed through software updates, in which case systems that remain vulnerable might be mainly those that are running out-of-date software. ---
**Author:** ![skaushalye](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@skaushalye](https://community.letsencrypt.org/u/skaushalye)\ **Post date:** [January 20, 2021, 10:41pm UTC](https://community.letsencrypt.org/t/ssl-tls-adaptive-chosen-ciphertext-attack-vulnerability-against-rsa-robot-attack/143191/4 "2021-01-20T22:41:14Z")
Thank you for your suggestions. I have update the vhost file with this given values. It works, but there were number of issues in our vhost files & configurations. Later, I changed the SSLCipherSuite value as this: SSLCipherSuite HIGH:!SSLv2:!ADH:!aNULL:!eNULL:!NULL ---
**Author:** ![skaushalye](https://avatars.discourse-cdn.com/v4/letter/s/258eb7/32.png) [@skaushalye](https://community.letsencrypt.org/u/skaushalye)\ **Post date:** [January 20, 2021, 10:53pm UTC](https://community.letsencrypt.org/t/ssl-tls-adaptive-chosen-ciphertext-attack-vulnerability-against-rsa-robot-attack/143191/5 "2021-01-20T22:53:40Z")
Finally I got the all green result in SSL report. The server configuration (vhost) were bit messy (multiple vhost files) and different certificates has mapped. So if you facing the same kind of issue, please check the all relevant vhosts, certificates and their paths first. But when I am testing in [https://www.ssllabs.com](https://www.ssllabs.com) first I used Chrome, but every time it returns same results even after I did the number of changes, and clear the cache (both browser & sslabs site). Then I jumped to Firefox private browsing. Then I found there are different issues. As @rg305 recommended I removed the +TLSv1.1 from SSLProtocol: `SSLProtocol -All +TLSv1.2` And also set CipherSuite as: `SSLCipherSuite HIGH:!SSLv2:!ADH:!aNULL:!eNULL:!NULL` Check the certificate paths, their expiry dates, compare with the certificate details in the browser. Restart Apache2 . Test again in [www.ssllabs.com](http://www.ssllabs.com) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 19, 2021, 10:53pm UTC](https://community.letsencrypt.org/t/ssl-tls-adaptive-chosen-ciphertext-attack-vulnerability-against-rsa-robot-attack/143191/6 "2021-02-19T22:53:42Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.