- Home
- CVEs with nessus.description==The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before
1.0.1g do not properly handle Heartbeat Extension packets, which
allows remote attackers to obtain sensitive information from process
memory via crafted packets that trigger a buffer over-read, as
demonstrated by reading private keys, related to d1_both.c and
t1_lib.c, aka the Heartbleed bug. (CVE-2014-0160)
Impact
A malicious user can exploit vulnerable systems and retrieve
information from memory. This information may potentially include user
credentials or the private keys used for Transport Layer Security
(TLS) or Datagram Transport Layer Security (DTLS). For information
about vulnerable components or features, refer to the following list :
Virtual servers using aSecure Sockets Layer (SSL) profile configured
with the default Native SSL ciphers are not vulnerable. Only virtual
servers using an SSL profile configured to use ciphers from the COMPAT
SSL stack are vulnerable in BIG-IP 11.5.0 and 11.5.1. Additionally,
virtual servers that do not use SSL profiles and pass SSL traffic to
the back-end web servers will not protect the back-end resource
servers.
The Configuration utility and other services, such as iControl, are
vulnerable.
The big3d process included with BIG-IP GTM 11.5.0 and 11.5.1 is
vulnerable. Additionally, monitored BIG-IP systems whose big3d process
was updated by an affected BIG-IP GTM system are also vulnerable.
The big3d process included with Enterprise Manager 3.1.1 HF1 and HF2
is vulnerable. Additionally, monitored BIG-IP systems whose big3d
process was updated by an affected Enterprise Manager system are also
vulnerable.
The BIG-IP Edge Client for Android is not vulnerable. However, the
BIG-IP Edge Client for Windows, Mac OS, and Linux is vulnerable. An
attacker can retrieve sensitive information by using the stated
vulnerability in the following scenarios: User is tricked into
connecting to any malicious SSL server.
User connects to a compromised FirePass or BIG-IP APM system.
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top