Your "basic RSA" is probably not standard RSA as specified in PKCS#1, but the so-called "textbook RSA", which is insecure because it is reduced to the core modular exponentiation and does not include the padding, which is essential.
In "textbook RSA", public key consists in n (modulus) and e (public exponent). Private key is d (private exponent). Plaintexts are integers modulo n. The encryption of m is me mod n; decryption is obtained by raising to the power d because (me)d = m mod n for all integers m in the 0 to n-1 range.
Indeed, textbook RSA is not secure against Chosen Ciphertext Attacks because of the following: for the modulus n and all messages m and m', you have:
(mm')e = (me)(m'e) mod n
In other words, the encryption of a product is the product of the encryptions. In the CCA setup:
- There is a message m and its ciphertext c = me mod n. Attacker knows c and wants to find m.
- Attacker is allowed to obtain the decryption of ciphertexts that he chooses, as long as none of them is equal to c.
- Attacker generates a random m' (modulo n) and computes c' = m'e mod n.
- Attacker asks for the decryption of cc' mod n: this is an integer modulo n, distinct from c, so the attacker gets a response.
- The response is necessarily equals to mm' mod n. Attacker knows m' (he chose it himself) so he computed m easily.
As for Chosen Plaintext Attacks: asymmetric encryption is necessarily secure against CPA, if it is to offer any security at all. Indeed, encryption uses the public key, which is public, thus known to everybody, including the attacker. If the attacker wants to encrypt some messages of his choosing, then he... just does it. He does not need any help from the private key owner, since encryption uses only public elements.
If textbook RSA was not secure against CPA, then standard RSA, with the padding, would be weak too: using his breaking method, the attacker would recover the padded message, from which he would obtain the non-padded message.
Now this does not mean that textbook RSA is secure against attackers who cannot obtain the decryption of custom ciphertexts. Textbook RSA has (at least) the following very serious issues:
- As noted above, it is insecure against CCA.
- If the message is a small integer, then the RSA problem may become very easy. For instance, if m is a 200-bit integer and the public exponent is e = 3, then me is a 600-bit integer, while the modulus is normally larger (at least 1024 bits). This implies that m can be recovered with a simple, non-modular cube root (which is easy).
- Textbook RSA is deterministic; thus, if the message itself is amenable to brute force (e.g. it is a password), then it can be recovered by trying potential message values until a match is found.
Standard padding, as specified in PKCS#1, solves these issues: the padding ensures that the padded integer is large enough; padding includes random bytes. The old-style PKCS#1 padding (dubbed "v1.5") is actually not very strong against CCA, although it still is tolerably good when employed properly, as in SSL (it requires that the SSL server does not complain when the decryption of what the client sends does not have a syntactically valid padding). The new-style PKCS#1 padding (dubbed "OAEP") is strong (and even "proven strong" for an appropriate meaning of "proven").