1. CVE-Search
  2. CVE-2014-3812
ID CVE-2014-3812
Summary The Juniper Junos Pulse Secure Access Service (SSL VPN) devices with IVE OS before 7.4r5 and 8.x before 8.0r1 and Junos Pulse Access Control Service (UAC) before 4.4r5 and 5.x before 5.0r1 enable cipher suites with weak encryption algorithms, which make it easier for remote attackers to obtain sensitive information by sniffing the network.
References
Vulnerable Configurations
  • cpe:2.3:o:juniper:ive_os:7.4:*:*:*:*:*:*:*
    cpe:2.3:o:juniper:ive_os:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:juniper:ive_os:8.0:*:*:*:*:*:*:*
    cpe:2.3:o:juniper:ive_os:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:juniper:unified_access_control_software:4.4:*:*:*:*:*:*:*
    cpe:2.3:o:juniper:unified_access_control_software:4.4:*:*:*:*:*:*:*
  • cpe:2.3:o:juniper:unified_access_control_software:5.0:*:*:*:*:*:*:*
    cpe:2.3:o:juniper:unified_access_control_software:5.0:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:fips_infranet_controller_6500:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:fips_infranet_controller_6500:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:fips_secure_access_4000:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:fips_secure_access_4000:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:fips_secure_access_4500:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:fips_secure_access_4500:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:fips_secure_access_6000:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:fips_secure_access_6000:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:fips_secure_access_6500:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:fips_secure_access_6500:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:infranet_controller_4000:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:infranet_controller_4000:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:infranet_controller_4500:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:infranet_controller_4500:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:infranet_controller_6000:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:infranet_controller_6000:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:infranet_controller_6500:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:infranet_controller_6500:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:mag2600_gateway:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:mag2600_gateway:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:mag4610_gateway:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:mag4610_gateway:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:mag6610_gateway:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:mag6610_gateway:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:mag6611_gateway:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:mag6611_gateway:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:secure_access_2500:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:secure_access_2500:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:secure_access_4500:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:secure_access_4500:-:*:*:*:*:*:*:*
  • cpe:2.3:h:juniper:secure_access_700:-:*:*:*:*:*:*:*
    cpe:2.3:h:juniper:secure_access_700:-:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 16-06-2014 - 13:26)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
confirm http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10628
Last major update 16-06-2014 - 13:26
Published 13-06-2014 - 14:55
Last modified 16-06-2014 - 13:26
Back to Top