(HP Issues Fix for HP VPN Firewall Module) OpenSSL SSL 3.0 Protocol Downgrade Flaw Lets Remote Users Decrypt SSL Traffic
|
|
SecurityTracker Alert ID: 1032509 |
|
SecurityTracker URL: http://securitytracker.com/id/1032509
|
|
CVE Reference:
CVE-2014-3566
(Links to External Site)
|
Date: Jun 5 2015
|
Impact:
Disclosure of system information, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
|
Description:
A vulnerability was reported in OpenSSL. A remote user can decrypt SSL sessions in certain cases. HP VPN Firewall Module is affected.
A remote user can with the ability to conduct a man-in-the-middle attack can force a client to negotiate a downgrade to SSLv3 instead of a TLS v1.x protocol and then conduct a BEAST-style of attack to decrypt portions of the session.
This protocol vulnerability is referred to as the POODLE ("Padding Oracle On Downgraded Legacy Encryption") vulnerability.
This is a flaw in the protocol rather than in the OpenSSL implementation.
The original advisory is available at:
https://www.openssl.org/~bodo/ssl-poodle.pdf
Bodo Moller, Thai Duong, and Krzysztof Kotowicz reported this vulnerability.
|
Impact:
A remote user with the ability to conduct a man-in-the-middle attack can decrypt SSL sessions.
|
Solution:
HP has issued an advisory for HP VPN Firewall Module.
For SecBlade FW (fixed version R3181P05):
JC635A HP 12500 VPN Firewall Module
JD245A HP 9500 VPN Firewall Module
JD249A HP 10500/7500 Advanced VPN Firewall Mod
JD250A HP 6600 Firewall Processing Rtr Module
JD251A HP 8800 Firewall Processing Module
JD255A HP 5820 VPN Firewall Module
H3C S9500E SecBlade VPN Firewall Module (0231A0AV)
H3C S7500E SecBlade VPN Firewall Module (0231A832)
H3C SR66 Gigabit Firewall Module (0231A88A)
H3C SR88 Firewall Processing Module (0231A88L)
H3C S5820 SecBlade VPN Firewall Module (0231A94J)
For F1000-E (fixed version R3181P05):
JD272A HP F1000-E VPN Firewall Appliance
For F1000-A (fixed version R3734P06):
JG214A HP F1000-A-EI VPN Firewall Appliance
For F1000-S (fixed version R3734P06):
JG213A HP F1000-S-EI VPN Firewall Appliance
The HP advisory is available at:
http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04616259
|
Vendor URL: h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04616259 (Links to External Site)
|
Cause:
Access control error
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
