SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Device (Router/Bridge/Hub)  >   F5 BIG-IP Vendors:   F5 Networks
(F5 Issues Advisory for F5 BIG-IP) OpenSSL TLS Heartbeat Buffer Overread Lets Remote Users Obtain Potentially Sensitive Information
SecurityTracker Alert ID:  1030052
SecurityTracker URL:  http://securitytracker.com/id/1030052
CVE Reference:   CVE-2014-0160   (Links to External Site)
Date:  Apr 11 2014
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 11.5.0 - 11.5.1
Description:   A vulnerability was reported in OpenSSL. A remote user can obtain potentially sensitive information. F5 BIG-IP is affected.

A remote client or server can trigger a buffer overread in the processing of the TLS heartbeat extension to obtain up to 64k of memory (per heartbeat request), potentially including encryption keys.

The vulnerability was introduced to the source code in December 2011 and to release version 1.0.1 in March 2012.

[Editor's note: This vulnerability is known as the OpenSSL heartbleed vulnerability.]

Neel Mehta of Google Security reported this vulnerability.

Impact:   A remote user can obtain potentially sensitive information, including encryption keys.
Solution:   F5 BIG-IP versions 11.5.0 - 11.5.1 are affected. No solution was available at the time of this entry.

Some earlier versions are not affected. F5 recommends using a version that is known to be not vulnerable, as described in their advisory.

F5 has assigned ID 456033 (BIG-IP), ID 456302 (BIG-IP Edge Client for Windows, Mac OS, and Linux), and ID 456345 (BIG-IP Edge Client for Apple iOS) to this vulnerability.

The F5 advisory is available at:

http://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html

Vendor URL:  www.openssl.org/news/secadv_20140407.txt (Links to External Site)
Cause:   Access control error, Boundary error

Message History:   This archive entry is a follow-up to the message listed below.
Apr 8 2014 OpenSSL TLS Heartbeat Buffer Overread Lets Remote Users Obtain Potentially Sensitive Information



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC