Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Device (Encryption/VPN)  >   HPE VPN Firewall Module Vendors:   HPE
(HP Issues Fix for HP VPN Firewall Module) OpenSSL SSL 3.0 Protocol Downgrade Flaw Lets Remote Users Decrypt SSL Traffic
SecurityTracker Alert ID:  1032509
SecurityTracker URL:
CVE Reference:   CVE-2014-3566   (Links to External Site)
Date:  Jun 5 2015
Impact:   Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   A vulnerability was reported in OpenSSL. A remote user can decrypt SSL sessions in certain cases. HP VPN Firewall Module is affected.

A remote user can with the ability to conduct a man-in-the-middle attack can force a client to negotiate a downgrade to SSLv3 instead of a TLS v1.x protocol and then conduct a BEAST-style of attack to decrypt portions of the session.

This protocol vulnerability is referred to as the POODLE ("Padding Oracle On Downgraded Legacy Encryption") vulnerability.

This is a flaw in the protocol rather than in the OpenSSL implementation.

The original advisory is available at:

Bodo Moller, Thai Duong, and Krzysztof Kotowicz reported this vulnerability.

Impact:   A remote user with the ability to conduct a man-in-the-middle attack can decrypt SSL sessions.
Solution:   HP has issued an advisory for HP VPN Firewall Module.

For SecBlade FW (fixed version R3181P05):

JC635A HP 12500 VPN Firewall Module
JD245A HP 9500 VPN Firewall Module
JD249A HP 10500/7500 Advanced VPN Firewall Mod
JD250A HP 6600 Firewall Processing Rtr Module
JD251A HP 8800 Firewall Processing Module
JD255A HP 5820 VPN Firewall Module
H3C S9500E SecBlade VPN Firewall Module (0231A0AV)
H3C S7500E SecBlade VPN Firewall Module (0231A832)
H3C SR66 Gigabit Firewall Module (0231A88A)
H3C SR88 Firewall Processing Module (0231A88L)
H3C S5820 SecBlade VPN Firewall Module (0231A94J)

For F1000-E (fixed version R3181P05):

JD272A HP F1000-E VPN Firewall Appliance

For F1000-A (fixed version R3734P06):

JG214A HP F1000-A-EI VPN Firewall Appliance

For F1000-S (fixed version R3734P06):

JG213A HP F1000-S-EI VPN Firewall Appliance

The HP advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Access control error

Message History:   This archive entry is a follow-up to the message listed below.
Oct 15 2014 OpenSSL SSL 3.0 Protocol Downgrade Flaw Lets Remote Users Decrypt SSL Traffic

 Source Message Contents

[Original Message Not Available for Viewing]

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC